|
Description
Tomás Cohen Arazi (tcohen)
2025-07-01 15:05:21 UTC
Created attachment 184448 [details] [review] Bug 40286: Make C4::Auth::checkpw_internal use Koha::Patrons->find_by_identifier This patch does what the title says. The code change is clear to understand. The check for userid vs. cardnumber is done in the `find_by_identifier` method so no need to do it here. Note: When `find_by_identifier` was written, I picked some other place's logic (API password validation) so `userid` is used first for finding the patron. Because of this, tests in t/db_dependent/Auth.t need to be adjusted. I believe this is not an issue, as those tests should be removed once we move forward with bug 33905, entirely. To test: 1. Apply this patch 2. Run: $ ktd --shell k$ prove t/db_dependent/Auth.t => SUCCESS: Tests pass! 3. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> I'm not sure I understand the issue but sounds good to me?
Alternatively, we could use this as an opportunity to do some refactoring.
--
checkpw_internal() looks like it's used one place in C4::Auth::checkpw() and one place in C4::Auth_with_ldap::_do_changepassword().
And checkpw_internal() looks like it could be decomposed. At the moment, we're doing 3 things inside it.
1. Find patron (but Koha::Patrons->find_by_identifier() can already do this outside this function)
2. Check the password (via checkpw_hash())
3. Set the userenv unless $no_set_userenv
If we created a new function "C4::Auth::set_userenv({ patron => $patron })" or "C4::Context->set_userenv_from_patron" or something like that, then we don't really need checkpw_internal().
--
In the case of C4::Auth_with_ldap, we actually already have a borrowernumber and patron object before we even call checkpw_internal() anyway. We just need checkpw_hash() and maybe the userenv setting. The code in C4::Auth_wiith_ldap could use some TLC...
Honestly, the C4::Context->set_userenv in C4::Auth could use a bit of love too. But one mouthful of elephant at a time... Created attachment 185433 [details] [review] Bug 40286: Make C4::Auth::checkpw_internal use Koha::Patrons->find_by_identifier This patch does what the title says. The code change is clear to understand. The check for userid vs. cardnumber is done in the `find_by_identifier` method so no need to do it here. Note: When `find_by_identifier` was written, I picked some other place's logic (API password validation) so `userid` is used first for finding the patron. Because of this, tests in t/db_dependent/Auth.t need to be adjusted. I believe this is not an issue, as those tests should be removed once we move forward with bug 33905, entirely. To test: 1. Apply this patch 2. Run: $ ktd --shell k$ prove t/db_dependent/Auth.t => SUCCESS: Tests pass! 3. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: David Nind <david@davidnind.com> Created attachment 186764 [details] [review] Bug 40286: Make C4::Auth::checkpw_internal use Koha::Patrons->find_by_identifier This patch does what the title says. The code change is clear to understand. The check for userid vs. cardnumber is done in the `find_by_identifier` method so no need to do it here. Note: When `find_by_identifier` was written, I picked some other place's logic (API password validation) so `userid` is used first for finding the patron. Because of this, tests in t/db_dependent/Auth.t need to be adjusted. I believe this is not an issue, as those tests should be removed once we move forward with bug 33905, entirely. To test: 1. Apply this patch 2. Run: $ ktd --shell k$ prove t/db_dependent/Auth.t => SUCCESS: Tests pass! 3. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Nice work everyone! Pushed to main for 25.11 Please do not backport this one. This is causing t/db_dependent/api/v1/password_validation.t to fail now on main Until we find a solution to fix the failing tests I am reverting. |