Bug 40441

Summary: /auth/password/validation ( validateUserAndPassword ) requires too much permissions
Product: Koha Reporter: Lucas Gass (lukeg) <lucas>
Component: REST APIAssignee: Tomás Cohen Arazi (tcohen) <tomascohen>
Status: RESOLVED DUPLICATE QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dcook, tomascohen
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 40441: Add new permission api_validate_password
Bug 40441: Make /auth/password/validation use new permission

Description Lucas Gass (lukeg) 2025-07-17 21:03:06 UTC
In the API swagger definition for validateUserAndPassword: 


1184     x-koha-authorization:
1185       permissions:
1186         borrowers: "1"

Requiring the top level permission is more than should be needed. It shouldn't need delete_borrowers or send_messages_to_borrowers. 

We should add a new sub-permission for borrowers like 'api_validate_password'
Comment 1 David Cook 2025-07-23 23:07:09 UTC
I agree. I have patches on bug 36561. Can you take a look there?

I think Katrin marked it as Failed QA from Passed QA, although I don't know why.

*** This bug has been marked as a duplicate of bug 36561 ***
Comment 2 Tomás Cohen Arazi (tcohen) 2025-07-24 12:20:25 UTC
Created attachment 184588 [details] [review]
Bug 40441: Add new permission api_validate_password

This patch adds a new permission 'api_validate_password' that will be used
to control access to the /auth/password/validation endpoint.

The permission is added to:
- userpermissions.sql for new installations
- permissions.inc for display in the staff interface
- atomic update script for existing installations

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 3 Tomás Cohen Arazi (tcohen) 2025-07-24 12:20:28 UTC
Created attachment 184589 [details] [review]
Bug 40441: Make /auth/password/validation use new permission

This patch updates the /auth/password/validation endpoint to use the new
api_validate_password permission instead of the generic borrowers
permission.

This provides more granular control over who can use the password
validation API endpoint.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 4 Tomás Cohen Arazi (tcohen) 2025-07-24 12:21:38 UTC
(In reply to David Cook from comment #1)
> I agree. I have patches on bug 36561. Can you take a look there?
> 
> I think Katrin marked it as Failed QA from Passed QA, although I don't know
> why.
> 
> *** This bug has been marked as a duplicate of bug 36561 ***

Oops. Will do. Do you think we could go with my permission name/description? I believe is more accurate on the scope.