Bug 17006 - REST API: add route to change patron's password
Summary: REST API: add route to change patron's password
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Web services (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Lari Taskula
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 16652
  Show dependency treegraph
 
Reported: 2016-07-31 11:17 UTC by Jiri Kozlovsky
Modified: 2017-09-14 08:42 UTC (History)
6 users (show)

See Also:
Change sponsored?: Sponsored
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:
Municipal Libray Ceska Trebova


Attachments
Bug 17006: Add API route for changing patron's password (9.52 KB, patch)
2016-08-18 15:43 UTC, Lari Taskula
Details | Diff | Splinter Review
Bug 17006: Respect system preference "OpacPasswordChange" (3.82 KB, patch)
2016-08-18 16:01 UTC, Lari Taskula
Details | Diff | Splinter Review
Bug 17006: Add API route for changing patron's password (9.52 KB, patch)
2016-08-19 13:00 UTC, Lari Taskula
Details | Diff | Splinter Review
Bug 17006: Respect system preference "OpacPasswordChange" (3.82 KB, patch)
2016-08-19 13:00 UTC, Lari Taskula
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: Add API route for changing patron's password (9.59 KB, patch)
2016-08-22 23:00 UTC, Aleisha Amohia
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: Add API route for changing patron's password (9.59 KB, patch)
2016-08-22 23:01 UTC, Aleisha Amohia
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: Respect system preference "OpacPasswordChange" (3.89 KB, patch)
2016-08-22 23:01 UTC, Aleisha Amohia
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: Add API route for changing patron's password (21.86 KB, patch)
2016-10-11 09:47 UTC, Lari Taskula
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: Respect system preference "OpacPasswordChange" (4.00 KB, patch)
2016-10-11 09:47 UTC, Lari Taskula
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: Add API route for changing patron's password (10.28 KB, patch)
2016-10-11 09:50 UTC, Lari Taskula
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: Respect system preference "OpacPasswordChange" (4.00 KB, patch)
2016-10-11 09:51 UTC, Lari Taskula
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: Add API route for changing patron's password (10.16 KB, patch)
2016-10-12 13:53 UTC, Lari Taskula
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: Respect system preference "OpacPasswordChange" (4.00 KB, patch)
2016-10-12 13:53 UTC, Lari Taskula
Details | Diff | Splinter Review
Bug 17006: (follow-up) Test for changing another user's password (2.26 KB, patch)
2016-10-13 13:28 UTC, Lari Taskula
Details | Diff | Splinter Review
Bug 17006: (follow-up) Let librarians change patron's passwords (2.55 KB, patch)
2016-10-13 13:28 UTC, Lari Taskula
Details | Diff | Splinter Review
Bug 17006: (follow-up) Use Koha::Exceptions for change password endpoint (7.11 KB, patch)
2016-10-13 13:28 UTC, Lari Taskula
Details | Diff | Splinter Review
Bug 17006: (follow-up) Use Koha::Exceptions for change password endpoint (7.31 KB, patch)
2016-10-13 14:14 UTC, Lari Taskula
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: Add API route for changing patron's password (10.23 KB, patch)
2016-11-08 22:01 UTC, Josef Moravec
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: Respect system preference "OpacPasswordChange" (4.07 KB, patch)
2016-11-08 22:01 UTC, Josef Moravec
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: (follow-up) Test for changing another user's password (2.33 KB, patch)
2016-11-08 22:01 UTC, Josef Moravec
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: (follow-up) Let librarians change patron's passwords (2.61 KB, patch)
2016-11-08 22:01 UTC, Josef Moravec
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17006: (follow-up) Use Koha::Exceptions for change password endpoint (7.38 KB, patch)
2016-11-08 22:01 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 17006: Add API route for changing patron's password (10.17 KB, patch)
2017-05-10 10:31 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 17006: Respect system preference "OpacPasswordChange" (4.04 KB, patch)
2017-05-10 10:32 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 17006: (follow-up) Test for changing another user's password (2.32 KB, patch)
2017-05-10 10:32 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 17006: (follow-up) Let librarians change patron's passwords (2.60 KB, patch)
2017-05-10 10:32 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 17006: (follow-up) Use Koha::Exceptions for change password endpoint (7.42 KB, patch)
2017-05-10 10:32 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 17006: Add API route for changing patron's password (10.00 KB, patch)
2017-09-14 08:36 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 17006: Respect system preference "OpacPasswordChange" (4.04 KB, patch)
2017-09-14 08:36 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 17006: (follow-up) Test for changing another user's password (2.32 KB, patch)
2017-09-14 08:36 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 17006: (follow-up) Let librarians change patron's passwords (2.60 KB, patch)
2017-09-14 08:36 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 17006: (follow-up) Use Koha::Exceptions for change password endpoint (7.42 KB, patch)
2017-09-14 08:36 UTC, Josef Moravec
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jiri Kozlovsky 2016-07-31 11:17:22 UTC
Add API to change patron's password.

This is useful especially for 3rd party applications like VuFind.
Comment 1 Lari Taskula 2016-08-18 15:43:52 UTC Comment hidden (obsolete)
Comment 2 Lari Taskula 2016-08-18 16:01:18 UTC Comment hidden (obsolete)
Comment 3 Lari Taskula 2016-08-19 13:00:28 UTC Comment hidden (obsolete)
Comment 4 Lari Taskula 2016-08-19 13:00:42 UTC Comment hidden (obsolete)
Comment 5 Aleisha Amohia 2016-08-22 23:00:07 UTC Comment hidden (obsolete)
Comment 6 Aleisha Amohia 2016-08-22 23:01:02 UTC
Created attachment 54717 [details] [review]
[SIGNED-OFF] Bug 17006: Add API route for changing patron's password

PATCH /patrons/{borrowernumber}/password (change password)

Required body params:
- current_password
- new_password

To test:
1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
4. Make sure that password was changed.
5. Try also too short password, and wrong current password and observe
   that errors are displayed appropriately.

You may find this useful for testing:

curl -X PATCH http://library/api/v1/patrons/123/password
     --data '{"current_password":"123456", "new_password":"1234"}'
     --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Comment 7 Aleisha Amohia 2016-08-22 23:01:11 UTC
Created attachment 54718 [details] [review]
[SIGNED-OFF] Bug 17006: Respect system preference "OpacPasswordChange"

Allow patron to change their own password without borrowers-flag only
if OpacPasswordChange system preference is enabled.

To test:
1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Set OpacPasswordChange system preference to "Don't allow".
4. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber for a borrower that does not
   have any permissions
5. Observe permission error.
6. Set OpacPasswordChange system preference to "Allow".
7. Repeat step 4 and make sure that password was changed.

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Comment 8 Lari Taskula 2016-10-11 09:47:08 UTC
Created attachment 56155 [details] [review]
[SIGNED-OFF] Bug 17006: Add API route for changing patron's password

PATCH /patrons/{borrowernumber}/password (change password)

Required body params:
- current_password
- new_password

To test:
1. Apply patch and minify swagger.json
perl misc/devel/minifySwagger.pl -s api/v1/swagger/swagger.json -d api/v1/swagger/swagger.min.json
2. Run t/db_dependent/api/v1/patrons.t
3. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
4. Make sure that password was changed.
5. Try also too short password, and wrong current password and observe
   that errors are displayed appropriately.

You may find this useful for testing:

curl -X PATCH http://library/api/v1/patrons/123/password
     --data '{"current_password":"123456", "new_password":"1234"}'
     --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Comment 9 Lari Taskula 2016-10-11 09:47:40 UTC
Created attachment 56156 [details] [review]
[SIGNED-OFF] Bug 17006: Respect system preference "OpacPasswordChange"

Allow patron to change their own password without borrowers-flag only
if OpacPasswordChange system preference is enabled.

To test:
1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Set OpacPasswordChange system preference to "Don't allow".
4. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber for a borrower that does not
   have any permissions
5. Observe permission error.
6. Set OpacPasswordChange system preference to "Allow".
7. Repeat step 4 and make sure that password was changed.

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Comment 10 Lari Taskula 2016-10-11 09:50:42 UTC
Created attachment 56157 [details] [review]
[SIGNED-OFF] Bug 17006: Add API route for changing patron's password

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Comment 11 Lari Taskula 2016-10-11 09:51:33 UTC
Created attachment 56158 [details] [review]
[SIGNED-OFF] Bug 17006: Respect system preference "OpacPasswordChange"

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Comment 12 Lari Taskula 2016-10-11 09:51:48 UTC
Rebased on top of master.
Comment 13 Lari Taskula 2016-10-12 13:53:29 UTC
Created attachment 56283 [details] [review]
[SIGNED-OFF] Bug 17006: Add API route for changing patron's password

PATCH /patrons/{borrowernumber}/password (change password)

Required body params:
- current_password
- new_password

To test:
1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
4. Make sure that password was changed.
5. Try also too short password, and wrong current password and observe
   that errors are displayed appropriately.

You may find this useful for testing:

curl -X PATCH http://library/api/v1/patrons/123/password
     --data '{"current_password":"123456", "new_password":"1234"}'
     --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Comment 14 Lari Taskula 2016-10-12 13:53:53 UTC
Created attachment 56284 [details] [review]
[SIGNED-OFF] Bug 17006: Respect system preference "OpacPasswordChange"

Allow patron to change their own password without borrowers-flag only
if OpacPasswordChange system preference is enabled.

To test:
1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Set OpacPasswordChange system preference to "Don't allow".
4. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber for a borrower that does not
   have any permissions
5. Observe permission error.
6. Set OpacPasswordChange system preference to "Allow".
7. Repeat step 4 and make sure that password was changed.

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Comment 15 Lari Taskula 2016-10-12 14:01:56 UTC
Removed minification step from test plan after Bug 17432 was pushed to master.
Comment 16 Lari Taskula 2016-10-13 13:28:16 UTC
Created attachment 56399 [details] [review]
Bug 17006: (follow-up) Test for changing another user's password

The previous patches work for changing your own password, but the tests are
lacking a case where librarian attempts to change patron's password. This
feature was unnoticed and not implemented.

To test:
1. Run t/db_dependent/api/v1/patrons.t
2. Observe failing test
3. Proceed to next patch to fix the failing test
Comment 17 Lari Taskula 2016-10-13 13:28:37 UTC
Created attachment 56400 [details] [review]
Bug 17006: (follow-up) Let librarians change patron's passwords

This should obviously be part of this feature but was left unnoticed in the
first patch. If user has "borrowers"-flag, they should be able to change patron's
password without providing old password.

To test:
1. Run t/db_dependent/api/v1/patrons.t
2. Observe failing test
3. Apply patch
4. Run t/db_dependent/api/v1/patrons.t
5. Observe passing test
6. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
   and where YYY is not the same borrowernumber as your logged-in
   user's borrowernumber
7. Make sure that password was changed for YYY.

You may find this useful for testing:

curl -X PATCH http://library/api/v1/patrons/123/password \
     --data '{"new_password":"1234"}' \
     --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'
Comment 18 Lari Taskula 2016-10-13 13:28:58 UTC
Created attachment 56401 [details] [review]
Bug 17006: (follow-up) Use Koha::Exceptions for change password endpoint

Koha::Exceptions are a nice way to handle erros and they should be used much
more than they are now. This patch adds Koha::Exceptions into
Koha::Patron->change_password_to sub and catches the exceptions in the controller.

1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
4. Make sure that password was changed.
5. Try also too short password, and wrong current password and observe
   that errors are displayed appropriately.

curl -X PATCH http://library/api/v1/patrons/123/password \
         --data '{"current_password":"123", "new_password":"1234"}' \
         --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'
Comment 19 Lari Taskula 2016-10-13 14:14:45 UTC
Created attachment 56409 [details] [review]
Bug 17006: (follow-up) Use Koha::Exceptions for change password endpoint
Comment 20 Josef Moravec 2016-11-08 22:01:06 UTC
Created attachment 57356 [details] [review]
[SIGNED-OFF] Bug 17006: Add API route for changing patron's password

PATCH /patrons/{borrowernumber}/password (change password)

Required body params:
- current_password
- new_password

To test:
1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
4. Make sure that password was changed.
5. Try also too short password, and wrong current password and observe
   that errors are displayed appropriately.

You may find this useful for testing:

curl -X PATCH http://library/api/v1/patrons/123/password
     --data '{"current_password":"123456", "new_password":"1234"}'
     --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 21 Josef Moravec 2016-11-08 22:01:26 UTC
Created attachment 57357 [details] [review]
[SIGNED-OFF] Bug 17006: Respect system preference "OpacPasswordChange"

Allow patron to change their own password without borrowers-flag only
if OpacPasswordChange system preference is enabled.

To test:
1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Set OpacPasswordChange system preference to "Don't allow".
4. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber for a borrower that does not
   have any permissions
5. Observe permission error.
6. Set OpacPasswordChange system preference to "Allow".
7. Repeat step 4 and make sure that password was changed.

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 22 Josef Moravec 2016-11-08 22:01:34 UTC
Created attachment 57358 [details] [review]
[SIGNED-OFF] Bug 17006: (follow-up) Test for changing another user's password

The previous patches work for changing your own password, but the tests are
lacking a case where librarian attempts to change patron's password. This
feature was unnoticed and not implemented.

To test:
1. Run t/db_dependent/api/v1/patrons.t
2. Observe failing test
3. Proceed to next patch to fix the failing test

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 23 Josef Moravec 2016-11-08 22:01:39 UTC
Created attachment 57359 [details] [review]
[SIGNED-OFF] Bug 17006: (follow-up) Let librarians change patron's passwords

This should obviously be part of this feature but was left unnoticed in the
first patch. If user has "borrowers"-flag, they should be able to change patron's
password without providing old password.

To test:
1. Run t/db_dependent/api/v1/patrons.t
2. Observe failing test
3. Apply patch
4. Run t/db_dependent/api/v1/patrons.t
5. Observe passing test
6. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
   and where YYY is not the same borrowernumber as your logged-in
   user's borrowernumber
7. Make sure that password was changed for YYY.

You may find this useful for testing:

curl -X PATCH http://library/api/v1/patrons/123/password \
     --data '{"new_password":"1234"}' \
     --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 24 Josef Moravec 2016-11-08 22:01:45 UTC
Created attachment 57360 [details] [review]
[SIGNED-OFF] Bug 17006: (follow-up) Use Koha::Exceptions for change password endpoint

Koha::Exceptions are a nice way to handle erros and they should be used much
more than they are now. This patch adds Koha::Exceptions into
Koha::Patron->change_password_to sub and catches the exceptions in the controller.

1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
4. Make sure that password was changed.
5. Try also too short password, and wrong current password and observe
   that errors are displayed appropriately.

curl -X PATCH http://library/api/v1/patrons/123/password \
         --data '{"current_password":"123", "new_password":"1234"}' \
         --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 25 Mirko Tietgen 2017-05-10 09:34:20 UTC
I can't apply the last patch.

Wende an: Bug 17006: (follow-up) Use Koha::Exceptions for change password endpoint
fatal: sha1 information is lacking or useless (Koha/REST/V1/Patron.pm).
Dem Repository fehlen notwendige Blobs um auf einen 3-Wege-Merge zurückzufallen.
Kann nicht zu 3-Wege-Merge zurückfallen.
Anwendung des Patches fehlgeschlagen bei 0001 Bug 17006: (follow-up) Use Koha::Exceptions for change password endpoint
Comment 26 Josef Moravec 2017-05-10 10:31:49 UTC
Created attachment 63329 [details] [review]
Bug 17006: Add API route for changing patron's password

PATCH /patrons/{borrowernumber}/password (change password)

Required body params:
- current_password
- new_password

To test:
1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
4. Make sure that password was changed.
5. Try also too short password, and wrong current password and observe
   that errors are displayed appropriately.

You may find this useful for testing:

curl -X PATCH http://library/api/v1/patrons/123/password
     --data '{"current_password":"123456", "new_password":"1234"}'
     --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 27 Josef Moravec 2017-05-10 10:32:02 UTC
Created attachment 63330 [details] [review]
Bug 17006: Respect system preference "OpacPasswordChange"

Allow patron to change their own password without borrowers-flag only
if OpacPasswordChange system preference is enabled.

To test:
1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Set OpacPasswordChange system preference to "Don't allow".
4. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber for a borrower that does not
   have any permissions
5. Observe permission error.
6. Set OpacPasswordChange system preference to "Allow".
7. Repeat step 4 and make sure that password was changed.

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 28 Josef Moravec 2017-05-10 10:32:08 UTC
Created attachment 63331 [details] [review]
Bug 17006: (follow-up) Test for changing another user's password

The previous patches work for changing your own password, but the tests are
lacking a case where librarian attempts to change patron's password. This
feature was unnoticed and not implemented.

To test:
1. Run t/db_dependent/api/v1/patrons.t
2. Observe failing test
3. Proceed to next patch to fix the failing test

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 29 Josef Moravec 2017-05-10 10:32:16 UTC
Created attachment 63332 [details] [review]
Bug 17006: (follow-up) Let librarians change patron's passwords

This should obviously be part of this feature but was left unnoticed in the
first patch. If user has "borrowers"-flag, they should be able to change patron's
password without providing old password.

To test:
1. Run t/db_dependent/api/v1/patrons.t
2. Observe failing test
3. Apply patch
4. Run t/db_dependent/api/v1/patrons.t
5. Observe passing test
6. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
   and where YYY is not the same borrowernumber as your logged-in
   user's borrowernumber
7. Make sure that password was changed for YYY.

You may find this useful for testing:

curl -X PATCH http://library/api/v1/patrons/123/password \
     --data '{"new_password":"1234"}' \
     --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 30 Josef Moravec 2017-05-10 10:32:23 UTC
Created attachment 63333 [details] [review]
Bug 17006: (follow-up) Use Koha::Exceptions for change password endpoint

Koha::Exceptions are a nice way to handle erros and they should be used much
more than they are now. This patch adds Koha::Exceptions into
Koha::Patron->change_password_to sub and catches the exceptions in the controller.

1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
4. Make sure that password was changed.
5. Try also too short password, and wrong current password and observe
   that errors are displayed appropriately.

curl -X PATCH http://library/api/v1/patrons/123/password \
         --data '{"current_password":"123", "new_password":"1234"}' \
         --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 31 Josef Moravec 2017-05-10 10:33:15 UTC
(In reply to Mirko Tietgen from comment #25)
> I can't apply the last patch.
> 
> Wende an: Bug 17006: (follow-up) Use Koha::Exceptions for change password
> endpoint
> fatal: sha1 information is lacking or useless (Koha/REST/V1/Patron.pm).
> Dem Repository fehlen notwendige Blobs um auf einen 3-Wege-Merge
> zurückzufallen.
> Kann nicht zu 3-Wege-Merge zurückfallen.
> Anwendung des Patches fehlgeschlagen bei 0001 Bug 17006: (follow-up) Use
> Koha::Exceptions for change password endpoint

Rebased on master
Comment 32 Josef Moravec 2017-09-14 08:36:04 UTC
Created attachment 67128 [details] [review]
Bug 17006: Add API route for changing patron's password

PATCH /patrons/{borrowernumber}/password (change password)

Required body params:
- current_password
- new_password

To test:
1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
4. Make sure that password was changed.
5. Try also too short password, and wrong current password and observe
   that errors are displayed appropriately.

You may find this useful for testing:

curl -X PATCH http://library/api/v1/patrons/123/password
     --data '{"current_password":"123456", "new_password":"1234"}'
     --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 33 Josef Moravec 2017-09-14 08:36:08 UTC
Created attachment 67129 [details] [review]
Bug 17006: Respect system preference "OpacPasswordChange"

Allow patron to change their own password without borrowers-flag only
if OpacPasswordChange system preference is enabled.

To test:
1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Set OpacPasswordChange system preference to "Don't allow".
4. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber for a borrower that does not
   have any permissions
5. Observe permission error.
6. Set OpacPasswordChange system preference to "Allow".
7. Repeat step 4 and make sure that password was changed.

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 34 Josef Moravec 2017-09-14 08:36:12 UTC
Created attachment 67130 [details] [review]
Bug 17006: (follow-up) Test for changing another user's password

The previous patches work for changing your own password, but the tests are
lacking a case where librarian attempts to change patron's password. This
feature was unnoticed and not implemented.

To test:
1. Run t/db_dependent/api/v1/patrons.t
2. Observe failing test
3. Proceed to next patch to fix the failing test

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 35 Josef Moravec 2017-09-14 08:36:16 UTC
Created attachment 67131 [details] [review]
Bug 17006: (follow-up) Let librarians change patron's passwords

This should obviously be part of this feature but was left unnoticed in the
first patch. If user has "borrowers"-flag, they should be able to change patron's
password without providing old password.

To test:
1. Run t/db_dependent/api/v1/patrons.t
2. Observe failing test
3. Apply patch
4. Run t/db_dependent/api/v1/patrons.t
5. Observe passing test
6. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
   and where YYY is not the same borrowernumber as your logged-in
   user's borrowernumber
7. Make sure that password was changed for YYY.

You may find this useful for testing:

curl -X PATCH http://library/api/v1/patrons/123/password \
     --data '{"new_password":"1234"}' \
     --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 36 Josef Moravec 2017-09-14 08:36:20 UTC
Created attachment 67132 [details] [review]
Bug 17006: (follow-up) Use Koha::Exceptions for change password endpoint

Koha::Exceptions are a nice way to handle erros and they should be used much
more than they are now. This patch adds Koha::Exceptions into
Koha::Patron->change_password_to sub and catches the exceptions in the controller.

1. Apply patch
2. Run t/db_dependent/api/v1/patrons.t
3. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
4. Make sure that password was changed.
5. Try also too short password, and wrong current password and observe
   that errors are displayed appropriately.

curl -X PATCH http://library/api/v1/patrons/123/password \
         --data '{"current_password":"123", "new_password":"1234"}' \
         --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 37 Josef Moravec 2017-09-14 08:42:06 UTC
Rebased on master