Bug 28507 - Create Koha::Session wrapper to create consistent sessions throughout Koha
Summary: Create Koha::Session wrapper to create consistent sessions throughout Koha
Status: RESOLVED DUPLICATE of bug 31050
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: David Cook
QA Contact: Testopia
Depends on:
Reported: 2021-06-03 01:25 UTC by David Cook
Modified: 2022-11-12 07:32 UTC (History)
0 users

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2021-06-03 01:25:03 UTC
At the moment, there are a couple different places where authenticated sessions get created. One is checkauth() and another is check_api_auth(). 

I would also like to create consistently structured authenticated sessions from Koha Plugins.

There should be a standard API for creating and fetching sessions. I propose a Koha::Session wrapper. 

It will define Koha's standard session key set and have some automatic population for things like 'ip' and 'lasttime'. 

There will also be a method for setting the C4::Context->userenv, which is something that gets done repeatedly in checkauth(), check_api_auth(), check_cookie_auth(), and other less relevant places (like checkpw_internal which is bizarre).

I think that this is a reasonable step forward as we add AuthN and AuthZ to things like Koha plugins and Mojolicious controllers.
Comment 2 David Cook 2021-06-03 01:38:19 UTC
For instance:

    user => $patron,
    session => $session,
    extensions => {
      desk_id => $desk_id,
      shibboleth => $shibboleth,

We'd take both the session object and data to put into it. 

The $session object would have 'ip' and 'lasttime' set automatically. 


  session => $session,
  extensions => {
    id => $userid,

The above would use session data or let you override particular key/value pairs using extensions.

Although personally I find the concept of C4::Context->userenv to be unnecessary. You just need sessions, but Koha has a dependency on C4::Context->userenv...
Comment 3 David Cook 2022-04-12 00:54:17 UTC
Actually, I think the key thing is having Koha::Session enforce a number of mandatory session variables.

After reviewing C4::Auth::check_api_auth(), C4::Auth::checkauth(), C4::InstallAuth::checkauth(), the required keys for an authenticated user appear to be:

- number
- id
- cardnumber
- firstname
- surname
- branch
- branchname
- flags
- emailaddress
- ip 
- lasttime
- interface (not set by C4::InstallAuth::checkauth() but is by the other 2)

C4::Auth::checkauth() also sets "search_history", "desk_id", "desk_name", "shibboleth", "register_id", "register_name", "sco_user", and "cas_ticket". 

C4::Auth::check_api_auth() also sets "cas_ticket".
Comment 4 David Cook 2022-06-27 06:45:45 UTC

*** This bug has been marked as a duplicate of bug 31050 ***