Actions on API keys shoudl be logged and auditable (i.e. who creates the API keys, who revokes, etc).
Created attachment 186540 [details] [review] Bug 20638: Add ApiKeyLog system preference This patch adds the ApiKeyLog system preference to control logging of API key actions (creation, deletion, revocation, activation). The preference follows the same pattern as BorrowersLog and other logging preferences. Test plan: 1. Apply patch and run database update 2. Go to Administration > System preferences > Logs 3. Verify ApiKeyLog preference appears with Yes/No options 4. Verify default value is 'Don't log' (0)
Created attachment 186541 [details] [review] Bug 20638: Add revoke() and activate() methods to Koha::ApiKey This patch adds two new methods to Koha::ApiKey: - revoke(): Sets active to 0, throws exception if already revoked - activate(): Sets active to 1, throws exception if already active Both methods include proper exception handling and comprehensive tests. Test plan: 1. prove t/db_dependent/Koha/ApiKey.t 2. Verify new subtests pass for revoke() and activate() methods 3. Confirm exceptions are thrown for invalid state transitions
Created attachment 186542 [details] [review] Bug 20638: Update apikeys.pl and template with proper exception handling This patch comprehensively updates the API keys management interface to use the new revoke() and activate() methods with proper exception handling. Controller changes (members/apikeys.pl): - Add Try::Tiny and Scalar::Util imports for exception handling - Replace direct field manipulation (active(0)/active(1)) with proper method calls (revoke()/activate()) to ensure logging - Wrap method calls in try/catch blocks to handle specific exceptions: * Koha::Exceptions::ApiKey::AlreadyRevoked * Koha::Exceptions::ApiKey::AlreadyActive - Implement standard Koha messages pattern with @messages array - Improve code structure with elsif chain instead of multiple if statements - Add proper error handling for key_not_found cases - Include error_string for unhandled exceptions to aid debugging Template changes (koha-tmpl/.../apikeys.tt): - Add comprehensive error message handling for all exception types: * already_revoked: Clear message for revoked keys * already_active: Clear message for active keys * key_not_found: Message for missing keys * unhandled_exception: Generic message with detailed error string Key benefits: - All API key state changes are now properly logged when ApiKeyLog is enabled - Better user experience with specific, actionable error messages - Robust exception handling prevents crashes and provides debugging info - Improved code maintainability and extensibility
Created attachment 186543 [details] [review] Bug 20638: Add APIKEYS support to log viewer Add comprehensive support for viewing API key logs in the log viewer: tools/viewlog.pl: - Add APIKEYS to patron lookup logic alongside MEMBERS, CIRCULATION, FINES - Enable patron name display for API key log entries koha-tmpl/.../viewlog.tt: - Add APIKEYS to the modules list for filtering - Add ACTIVATE and REVOKE to the actions list for filtering - Include APIKEYS in patron display logic for object column koha-tmpl/.../action-logs.inc: - Add APIKEYS module translation: 'API keys' - Include ApiKeyLog system preference check with warning icon - Add ACTIVATE and REVOKE action translations - Maintain alphabetical order in translation blocks This enables librarians to view and filter API key creation, activation, revocation, and deletion activities in the standard log viewer interface, with proper patron name resolution and preference-based logging status indicators.
Created attachment 186544 [details] [review] Bug 20638: Include APIKEYS in 'Modification log'