Bug 20407 - Hide some fields from unauthorized users
Summary: Hide some fields from unauthorized users
Status: In Discussion
Alias: None
Product: Koha
Classification: Unclassified
Component: REST api (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Alex Arnaud
QA Contact:
URL: https://wiki.koha-community.org/wiki/...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-03-14 16:27 UTC by Alex Arnaud
Modified: 2018-10-11 19:45 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 20407 - REST API: Ability to hide fields from unauthorized users (2.33 KB, patch)
2018-03-14 16:31 UTC, Alex Arnaud
Details | Diff | Splinter Review
Bug 20407 - REST API: Ability to hide fields from unauthorized users (2.38 KB, patch)
2018-03-15 17:29 UTC, M. Tompsett
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Alex Arnaud 2018-03-14 16:27:29 UTC
The main goal here is to be able to make some fields/properties/columns "non public" to unauthorized people ( permission => catalogue ) by setting a "x-public" key to false in Swagger definitions files. Patch is coming...
Comment 1 Alex Arnaud 2018-03-14 16:31:32 UTC
Created attachment 72891 [details] [review]
Bug 20407 - REST API: Ability to hide fields from unauthorized users

Test plan:
  - apply this patch,
  - edit api/v1/swagger/definitions/city.json,
  - remove the keys "country" and "postal_code" from required,
  - add a key "x-public": false for country and postal_code
    "postal_code": {
      "description": "city postal code",
      "type": ["string", "null"],
      "x-public": false
    },
    "country": {
      "description": "city country",
      "type": ["string", "null"],
      "x-public": false
    }
  - logout from Koha and go to api/v1/cities,
  - you should not see country and postal_code,
  - login to Koha and refresh api/v1/cities,
  - you should see country and postal_code
Comment 2 M. Tompsett 2018-03-15 17:29:24 UTC
Created attachment 72982 [details] [review]
Bug 20407 - REST API: Ability to hide fields from unauthorized users

Test plan:
  - apply this patch,
  - edit api/v1/swagger/definitions/city.json,
  - remove the keys "country" and "postal_code" from required,
  - add a key "x-public": false for country and postal_code
    "postal_code": {
      "description": "city postal code",
      "type": ["string", "null"],
      "x-public": false
    },
    "country": {
      "description": "city country",
      "type": ["string", "null"],
      "x-public": false
    }
  - logout from Koha and go to api/v1/cities,
  - you should not see country and postal_code,
  - login to Koha and refresh api/v1/cities,
  - you should see country and postal_code

NOTE: Make sure to go to Koha administration and add cities before testing.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 3 Martin Renvoize 2018-05-21 14:50:46 UTC
The slightly more accepted way of doing this to date that I have seen is to reduce the default response to only contain public fields and set the private fields to need explicitly requesting in the api call. This way, rather than sending back a 200 with varying content you send back either a 200 with what the consumer has asked for (or is expecting) or you send back a 401 Unauthorized and the client knows to authenticate).

The principle of Least Surprise.

I do like the x-public way of defining it in the spec though.. :)
Comment 4 Tomás Cohen Arazi 2018-10-11 19:45:01 UTC
On a recent dev meeting it was voted to have a separate namespace (/public) for public facing endpoints. So while the logic here is valuable, this bug won't see progress as-is.