Bug 22061 - Add route to change patron's password (public)
Summary: Add route to change patron's password (public)
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: REST api (show other bugs)
Version: master
Hardware: All All
: P5 - low new feature (vote)
Assignee: Tomás Cohen Arazi
QA Contact:
URL: https://wiki.koha-community.org/wiki/...
Keywords:
Depends on: 17006
Blocks: 22216 22227
  Show dependency treegraph
 
Reported: 2019-01-02 15:22 UTC by Tomás Cohen Arazi
Modified: 2019-06-27 09:24 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Who signed the patch off:
Text to go in the release notes:
This new feature allows a user to change their own password via the public API
Version(s) released in:


Attachments
Bug 22061: Add RESTPublicAPI syspref (3.28 KB, patch)
2019-01-03 12:09 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 22061: Add a /public namespace that can be switched on/off (3.41 KB, patch)
2019-01-03 12:10 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 22061: Unit tests (4.00 KB, patch)
2019-01-07 11:32 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 22061: OpenAPI spec (746 bytes, patch)
2019-01-07 11:32 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 22061: Public route to change password (3.12 KB, patch)
2019-01-07 11:32 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 22061: OpenAPI spec (3.36 KB, patch)
2019-01-09 16:32 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 22061: Public route to change password (3.12 KB, patch)
2019-01-09 16:32 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 22061: Add RESTPublicAPI syspref (3.33 KB, patch)
2019-01-09 19:15 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 22061: Add a /public namespace that can be switched on/off (3.45 KB, patch)
2019-01-09 19:15 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 22061: Unit tests (4.05 KB, patch)
2019-01-09 19:16 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 22061: OpenAPI spec (3.41 KB, patch)
2019-01-09 19:16 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 22061: Public route to change password (3.18 KB, patch)
2019-01-09 19:16 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 22061: (QA follow-up) Rename password_2 => password_repeated (6.12 KB, patch)
2019-01-18 16:36 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 22061: Add RESTPublicAPI syspref (3.40 KB, patch)
2019-01-22 15:29 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 22061: Add RESTPublicAPI syspref (3.40 KB, patch)
2019-01-22 15:30 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 22061: Add a /public namespace that can be switched on/off (3.53 KB, patch)
2019-01-22 15:31 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 22061: Unit tests (4.12 KB, patch)
2019-01-22 15:31 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 22061: OpenAPI spec (3.48 KB, patch)
2019-01-22 15:31 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 22061: Public route to change password (3.25 KB, patch)
2019-01-22 15:31 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 22061: (QA follow-up) Rename password_2 => password_repeated (6.19 KB, patch)
2019-01-22 15:31 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 22061: (follow-up) set_password expects a hashref (1.46 KB, patch)
2019-01-28 15:45 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi 2019-01-02 15:22:51 UTC

    
Comment 1 Tomás Cohen Arazi 2019-01-03 12:08:57 UTC
I'm changing the bug description, because I didn't manage to have tests for the on/off switch without a real implemented route.
Comment 2 Tomás Cohen Arazi 2019-01-03 12:09:59 UTC
Created attachment 83613 [details] [review]
Bug 22061: Add RESTPublicAPI syspref
Comment 3 Tomás Cohen Arazi 2019-01-03 12:10:03 UTC
Created attachment 83614 [details] [review]
Bug 22061: Add a /public namespace that can be switched on/off

This patch adds a check in Koha::REST::V1::Auth::under to catch all
routes that begin with 'public' (inside /api/v1). If they match, and the
RESTPublicAPI syspref is off, then an exception is thrown, rendering a
403 error to the consumer.

Otherwise the routes are processed as usual. This is THE on/off switch
for the public REST API. The target use case: people not wanting an OPAC
or public interaction with the API besides privileged users.

In order to test, the rest of the patches are needed because the only
way to test a route is having it in the spec.

To test:
- Apply the patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/auth.t
=> SUCCESS: tests pass!
- Sign off :-D
Comment 4 Tomás Cohen Arazi 2019-01-03 12:11:06 UTC
Leaving this as ASSIGNED until I solve some bugs found in the process.
Comment 5 Tomás Cohen Arazi 2019-01-07 11:32:20 UTC
Created attachment 83680 [details] [review]
Bug 22061: Unit tests
Comment 6 Tomás Cohen Arazi 2019-01-07 11:32:25 UTC
Created attachment 83681 [details] [review]
Bug 22061: OpenAPI spec
Comment 7 Tomás Cohen Arazi 2019-01-07 11:32:28 UTC
Created attachment 83682 [details] [review]
Bug 22061: Public route to change password

This patch implements a route to change patron's password for
unprivileged users. It's intended for using in the OPAC (or however
consumers find it useful).

It is a starting point for the public API, and the bug also implements
the on/off switch some community members asked for.

To test:
- Apply this patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/patrons_password.t \
          t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass! i.e.
        - RESTPublicAPI is honoured
        - The /public/patrons/:patron_id/password endpoint works as
        expected
- Use your favourite API testing tool to try the endpoint.
- Sign off :-D
Comment 8 Josef Moravec 2019-01-09 15:26:54 UTC
t/db_dependent/api/v1/patrons_password.t .. Could not load document from /home/vagrant/kohaclone/api/v1/swagger/paths/public_patrons.json: Can't open file "/home/vagrant/kohaclone/api/v1/swagger/paths/public_patrons.json": No such file or directory at /usr/share/perl5/JSON/Validator.pm line 154.
Comment 9 Tomás Cohen Arazi 2019-01-09 16:32:11 UTC
Created attachment 83755 [details] [review]
Bug 22061: OpenAPI spec
Comment 10 Tomás Cohen Arazi 2019-01-09 16:32:14 UTC
Created attachment 83756 [details] [review]
Bug 22061: Public route to change password

This patch implements a route to change patron's password for
unprivileged users. It's intended for using in the OPAC (or however
consumers find it useful).

It is a starting point for the public API, and the bug also implements
the on/off switch some community members asked for.

To test:
- Apply this patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/patrons_password.t \
          t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass! i.e.
        - RESTPublicAPI is honoured
        - The /public/patrons/:patron_id/password endpoint works as
        expected
- Use your favourite API testing tool to try the endpoint.
- Sign off :-D
Comment 11 Josef Moravec 2019-01-09 19:15:53 UTC
Created attachment 83764 [details] [review]
Bug 22061: Add RESTPublicAPI syspref

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 12 Josef Moravec 2019-01-09 19:15:59 UTC
Created attachment 83765 [details] [review]
Bug 22061: Add a /public namespace that can be switched on/off

This patch adds a check in Koha::REST::V1::Auth::under to catch all
routes that begin with 'public' (inside /api/v1). If they match, and the
RESTPublicAPI syspref is off, then an exception is thrown, rendering a
403 error to the consumer.

Otherwise the routes are processed as usual. This is THE on/off switch
for the public REST API. The target use case: people not wanting an OPAC
or public interaction with the API besides privileged users.

In order to test, the rest of the patches are needed because the only
way to test a route is having it in the spec.

To test:
- Apply the patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/auth.t
=> SUCCESS: tests pass!
- Sign off :-D

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 13 Josef Moravec 2019-01-09 19:16:05 UTC
Created attachment 83766 [details] [review]
Bug 22061: Unit tests

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 14 Josef Moravec 2019-01-09 19:16:10 UTC
Created attachment 83767 [details] [review]
Bug 22061: OpenAPI spec

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 15 Josef Moravec 2019-01-09 19:16:15 UTC
Created attachment 83768 [details] [review]
Bug 22061: Public route to change password

This patch implements a route to change patron's password for
unprivileged users. It's intended for using in the OPAC (or however
consumers find it useful).

It is a starting point for the public API, and the bug also implements
the on/off switch some community members asked for.

To test:
- Apply this patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/patrons_password.t \
          t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass! i.e.
        - RESTPublicAPI is honoured
        - The /public/patrons/:patron_id/password endpoint works as
        expected
- Use your favourite API testing tool to try the endpoint.
- Sign off :-D

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 16 Tomás Cohen Arazi 2019-01-18 12:20:11 UTC
On the dev meeting it was requested that we change the 'password2' parameter into something that explains that it is a repeated password more explicitly.

I'll do it on a follow-up, but wanted to mention that the inspiration for this implementation was Django's:
https://django-rest-auth.readthedocs.io/en/latest/api_endpoints.html

and the fact that most of the examples on the web are quite similar too.
Comment 17 Tomás Cohen Arazi 2019-01-18 16:36:15 UTC
Created attachment 84207 [details] [review]
Bug 22061: (QA follow-up) Rename password_2 => password_repeated

As voted when the RFC was discussed, the attribute gets renamed. The
tests are adjusted accordingly.

To test:
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/patrons_password.t
=> SUCCESS: Tests pass!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 18 Kyle M Hall 2019-01-22 15:29:27 UTC
Created attachment 84288 [details] [review]
Bug 22061: Add RESTPublicAPI syspref

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 19 Kyle M Hall 2019-01-22 15:30:56 UTC
Created attachment 84289 [details] [review]
Bug 22061: Add RESTPublicAPI syspref

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 20 Kyle M Hall 2019-01-22 15:31:05 UTC
Created attachment 84290 [details] [review]
Bug 22061: Add a /public namespace that can be switched on/off

This patch adds a check in Koha::REST::V1::Auth::under to catch all
routes that begin with 'public' (inside /api/v1). If they match, and the
RESTPublicAPI syspref is off, then an exception is thrown, rendering a
403 error to the consumer.

Otherwise the routes are processed as usual. This is THE on/off switch
for the public REST API. The target use case: people not wanting an OPAC
or public interaction with the API besides privileged users.

In order to test, the rest of the patches are needed because the only
way to test a route is having it in the spec.

To test:
- Apply the patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/auth.t
=> SUCCESS: tests pass!
- Sign off :-D

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 21 Kyle M Hall 2019-01-22 15:31:08 UTC
Created attachment 84291 [details] [review]
Bug 22061: Unit tests

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 22 Kyle M Hall 2019-01-22 15:31:12 UTC
Created attachment 84292 [details] [review]
Bug 22061: OpenAPI spec

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 23 Kyle M Hall 2019-01-22 15:31:15 UTC
Created attachment 84293 [details] [review]
Bug 22061: Public route to change password

This patch implements a route to change patron's password for
unprivileged users. It's intended for using in the OPAC (or however
consumers find it useful).

It is a starting point for the public API, and the bug also implements
the on/off switch some community members asked for.

To test:
- Apply this patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/patrons_password.t \
          t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass! i.e.
        - RESTPublicAPI is honoured
        - The /public/patrons/:patron_id/password endpoint works as
        expected
- Use your favourite API testing tool to try the endpoint.
- Sign off :-D

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 24 Kyle M Hall 2019-01-22 15:31:18 UTC
Created attachment 84294 [details] [review]
Bug 22061: (QA follow-up) Rename password_2 => password_repeated

As voted when the RFC was discussed, the attribute gets renamed. The
tests are adjusted accordingly.

To test:
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/patrons_password.t
=> SUCCESS: Tests pass!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 25 Tomás Cohen Arazi 2019-01-28 15:45:18 UTC
Created attachment 84489 [details] [review]
Bug 22061: (follow-up) set_password expects a hashref

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 26 Nick Clemens 2019-01-28 16:11:50 UTC
Awesome work all!

Pushed to master for 19.05
Comment 27 Martin Renvoize 2019-02-01 15:25:08 UTC
New feature, will not be backported at this time to 18.11.x series.