Bug 29924 - Introduce password expiration to patron categories
Summary: Introduce password expiration to patron categories
Status: Pushed to master
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low new feature (vote)
Assignee: Nick Clemens
QA Contact: Tomás Cohen Arazi
URL:
Keywords:
Depends on:
Blocks: 29925 29926 30864 31382
  Show dependency treegraph
 
Reported: 2022-01-21 16:59 UTC by Nick Clemens
Modified: 2022-08-23 19:40 UTC (History)
9 users (show)

See Also:
Change sponsored?: Sponsored
Patch complexity: Small patch
Documentation contact: Caroline Cyr La Rose
Documentation submission: https://gitlab.com/koha-community/koha-manual/-/merge_requests/585
Text to go in the release notes:
Version(s) released in:
22.05.00


Attachments
Bug 29924: Database updates (4.85 KB, patch)
2022-01-21 17:16 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: DO NOT PUSH - Schema updates (4.65 KB, patch)
2022-01-21 17:16 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Add password expiration feature (13.69 KB, patch)
2022-01-21 17:16 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Unit tests (5.73 KB, patch)
2022-01-21 17:16 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Database updates (4.90 KB, patch)
2022-01-25 15:16 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 29924: DO NOT PUSH - Schema updates (4.69 KB, patch)
2022-01-25 15:16 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 29924: Add password expiration feature (13.79 KB, patch)
2022-01-25 15:16 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 29924: Unit tests (5.78 KB, patch)
2022-01-25 15:16 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message (2.00 KB, patch)
2022-01-25 15:16 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 29924: (follow-up) Generate necessary template variables before output (3.56 KB, patch)
2022-01-26 11:01 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Database updates (4.90 KB, patch)
2022-01-28 19:25 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: DO NOT PUSH - Schema updates (4.69 KB, patch)
2022-01-28 19:25 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Add password expiration feature (14.47 KB, patch)
2022-01-28 19:25 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Unit tests (7.12 KB, patch)
2022-01-28 19:25 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message (2.00 KB, patch)
2022-01-28 19:25 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Database updates (4.90 KB, patch)
2022-02-02 15:07 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: DO NOT PUSH - Schema updates (4.69 KB, patch)
2022-02-02 15:07 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Add password expiration feature (14.53 KB, patch)
2022-02-02 15:07 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Unit tests (7.19 KB, patch)
2022-02-02 15:07 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message (2.00 KB, patch)
2022-02-02 15:07 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add password_expiration_date to API (3.63 KB, patch)
2022-02-11 13:34 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Database updates (4.90 KB, patch)
2022-02-11 14:57 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 29924: DO NOT PUSH - Schema updates (4.69 KB, patch)
2022-02-11 14:57 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 29924: Add password expiration feature (14.59 KB, patch)
2022-02-11 14:57 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 29924: Unit tests (7.10 KB, patch)
2022-02-11 14:57 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message (2.00 KB, patch)
2022-02-11 14:57 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add password_expiration_date to API (3.68 KB, patch)
2022-02-11 14:57 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 29924: Database updates (4.90 KB, patch)
2022-02-14 18:23 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: DO NOT PUSH - Schema updates (4.69 KB, patch)
2022-02-14 18:23 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Add password expiration feature (14.59 KB, patch)
2022-02-14 18:23 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Unit tests (7.10 KB, patch)
2022-02-14 18:23 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message (2.06 KB, patch)
2022-02-14 18:23 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add password_expiration_date to API (3.68 KB, patch)
2022-02-14 18:23 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: (follow-up) Adjust test count (633 bytes, patch)
2022-02-14 18:23 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Database updates (4.95 KB, patch)
2022-02-16 17:18 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: DO NOT PUSH - Schema updates (4.75 KB, patch)
2022-02-16 17:18 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: Add password expiration feature (14.65 KB, patch)
2022-02-16 17:18 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: Unit tests (7.15 KB, patch)
2022-02-16 17:18 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message (2.11 KB, patch)
2022-02-16 17:18 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add password_expiration_date to API (3.73 KB, patch)
2022-02-16 17:18 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: (follow-up) Adjust test count (685 bytes, patch)
2022-02-16 17:18 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add default value undef for TestBuilder (734 bytes, patch)
2022-02-25 18:46 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Database updates (4.95 KB, patch)
2022-03-23 16:00 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Add password expiration feature (14.58 KB, patch)
2022-03-23 16:01 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Unit tests (7.15 KB, patch)
2022-03-23 16:01 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message (2.11 KB, patch)
2022-03-23 16:01 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add password_expiration_date to API (3.73 KB, patch)
2022-03-23 16:01 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add default value undef for TestBuilder (734 bytes, patch)
2022-03-23 16:01 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: DO NOT PUSH - Schema updates (4.63 KB, patch)
2022-03-23 16:01 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Update ILSDI to be aware of expired passwords (4.69 KB, patch)
2022-03-23 16:01 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Update ILSDI to be aware of expired passwords (4.96 KB, patch)
2022-03-23 20:29 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Database updates (5.01 KB, patch)
2022-03-23 21:02 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: Add password expiration feature (14.64 KB, patch)
2022-03-23 21:02 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: Unit tests (7.22 KB, patch)
2022-03-23 21:02 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message (2.18 KB, patch)
2022-03-23 21:02 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add password_expiration_date to API (3.80 KB, patch)
2022-03-23 21:02 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add default value undef for TestBuilder (800 bytes, patch)
2022-03-23 21:02 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: DO NOT PUSH - Schema updates (4.69 KB, patch)
2022-03-23 21:03 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: Update ILSDI to be aware of expired passwords (5.02 KB, patch)
2022-03-23 21:03 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 29924: Database updates (5.01 KB, patch)
2022-04-25 11:32 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Add password expiration feature (14.64 KB, patch)
2022-04-25 11:32 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Unit tests (7.37 KB, patch)
2022-04-25 11:32 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message (2.18 KB, patch)
2022-04-25 11:32 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add password_expiration_date to API (3.78 KB, patch)
2022-04-25 11:32 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add default value undef for TestBuilder (800 bytes, patch)
2022-04-25 11:32 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Update ILSDI to be aware of expired passwords (5.04 KB, patch)
2022-04-25 11:33 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: DO NOT PUSH - Schema updates (4.63 KB, patch)
2022-04-25 11:33 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 29924: Database updates (5.07 KB, patch)
2022-04-25 14:29 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29924: Add password expiration feature (14.71 KB, patch)
2022-04-25 14:29 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29924: Unit tests (7.43 KB, patch)
2022-04-25 14:30 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message (2.24 KB, patch)
2022-04-25 14:30 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add password_expiration_date to API (3.83 KB, patch)
2022-04-25 14:31 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29924: (follow-up) Add default value undef for TestBuilder (857 bytes, patch)
2022-04-25 14:31 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29924: Update ILSDI to be aware of expired passwords (5.10 KB, patch)
2022-04-25 14:32 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29924: DO NOT PUSH - Schema updates (4.69 KB, patch)
2022-04-25 14:32 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29924: (QA follow-up) Remove password_expiration_date from API (4.22 KB, patch)
2022-04-25 14:32 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29924: Add tests for API Basic auth behavior (1.56 KB, patch)
2022-04-25 14:33 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29924: Avoid leaking information on wrong credentials (2.56 KB, patch)
2022-04-26 18:08 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 29924: (follow-up) Fix t/db_dependent/Koha/Patron.t number of tests (670 bytes, patch)
2022-05-06 19:42 UTC, Fridolin Somers
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens 2022-01-21 16:59:17 UTC

    
Comment 1 Nick Clemens 2022-01-21 17:16:17 UTC Comment hidden (obsolete)
Comment 2 Nick Clemens 2022-01-21 17:16:21 UTC Comment hidden (obsolete)
Comment 3 Nick Clemens 2022-01-21 17:16:24 UTC Comment hidden (obsolete)
Comment 4 Nick Clemens 2022-01-21 17:16:27 UTC Comment hidden (obsolete)
Comment 5 Owen Leonard 2022-01-25 15:16:32 UTC Comment hidden (obsolete)
Comment 6 Owen Leonard 2022-01-25 15:16:36 UTC Comment hidden (obsolete)
Comment 7 Owen Leonard 2022-01-25 15:16:40 UTC Comment hidden (obsolete)
Comment 8 Owen Leonard 2022-01-25 15:16:43 UTC Comment hidden (obsolete)
Comment 9 Owen Leonard 2022-01-25 15:16:46 UTC Comment hidden (obsolete)
Comment 10 Owen Leonard 2022-01-25 15:20:19 UTC
Some thoughts:

- Why is the "Your password has expired" page in the OPAC empty, whereas the "Incorrect password" page shows the search bar and the other search links?

- Should we show the password expiration on the patron detail page? Under the password line?

- Should we show a (non-blocking) warning on the checkout page when a patron's password has expired like we do when their account has expired?
Comment 11 Nick Clemens 2022-01-26 11:01:38 UTC Comment hidden (obsolete)
Comment 12 Nick Clemens 2022-01-26 11:04:23 UTC
(In reply to Owen Leonard from comment #10)
> Some thoughts:
> 
> - Why is the "Your password has expired" page in the OPAC empty, whereas the
> "Incorrect password" page shows the search bar and the other search links?

Fixed - we generate a lot of necessary content for the template in the routine, so I delay the output until the end

> - Should we show the password expiration on the patron detail page? Under
> the password line?
> 
> - Should we show a (non-blocking) warning on the checkout page when a
> patron's password has expired like we do when their account has expired?

I am not sure on these, on other systems where my password expires I don't see these. It is debatable whether general staff need to know this, I think these options would need to be configurable, open a follow-up bug?
Comment 13 Nick Clemens 2022-01-28 19:25:08 UTC Comment hidden (obsolete)
Comment 14 Nick Clemens 2022-01-28 19:25:12 UTC Comment hidden (obsolete)
Comment 15 Nick Clemens 2022-01-28 19:25:16 UTC Comment hidden (obsolete)
Comment 16 Nick Clemens 2022-01-28 19:25:20 UTC Comment hidden (obsolete)
Comment 17 Nick Clemens 2022-01-28 19:25:24 UTC Comment hidden (obsolete)
Comment 18 Nick Clemens 2022-02-02 15:07:10 UTC Comment hidden (obsolete)
Comment 19 Nick Clemens 2022-02-02 15:07:13 UTC Comment hidden (obsolete)
Comment 20 Nick Clemens 2022-02-02 15:07:17 UTC Comment hidden (obsolete)
Comment 21 Nick Clemens 2022-02-02 15:07:20 UTC Comment hidden (obsolete)
Comment 22 Nick Clemens 2022-02-02 15:07:25 UTC Comment hidden (obsolete)
Comment 23 Nick Clemens 2022-02-11 13:34:57 UTC Comment hidden (obsolete)
Comment 24 Owen Leonard 2022-02-11 14:57:15 UTC
Created attachment 130500 [details] [review]
Bug 29924: Database updates

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 25 Owen Leonard 2022-02-11 14:57:19 UTC
Created attachment 130501 [details] [review]
Bug 29924: DO NOT PUSH - Schema updates

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 26 Owen Leonard 2022-02-11 14:57:23 UTC
Created attachment 130502 [details] [review]
Bug 29924: Add password expiration feature

This patch adds the ability to define password_expiry_days for a patron
category.

When defined a patron's password will expire after X days and they will
be required to reset their password. If OPAC resets are enabled for the
catgeory they may do so on their own, otherwise they will need to
contact the library

To test:
 1 - Apply patch, updatedatabase
 2 - Set 'Password expiration' for a patron category
     Home-> Administration-> Patron categories-> Edit
 3 - Create a new patron in this category with a userid/password set,
     and an email
 4 - Confirm their password_expiration_date field is set
     SELECT password_expiration_date FROM borrowers WHERE borrowernumber=51;
 5 - Create a new patron, do not set a password
 6 - Confirm their password_expiration_date field is NULL
 7 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration_date='2022-01-01' WHERE borrowernumber=51;
 8 - Give the borrower catalogue permission
 9 - Attempt to log in to Straff interface
10 - Confirm you are signed out and notified that password must be
     reset
11 - Attempt to sign in to OPAC
12 - Confirm you are signed out and notified password must be reset
13 - Enable password reset for the patron's category and perform a
     password reset
     Note: you will have to find the link in the message_queue unless
     you have emails setup on your test environment
     SELECT * FROM message_queue WHERE borrowernumber=51;
14 - Confirm that you can now sign in and password_expiration_date field
     is set 10 days in the future
15 - Expire the patron's password again
16 - Change the patron's password via the staff interface
17 - Confirm they can sign in and the expiration is updated

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 27 Owen Leonard 2022-02-11 14:57:26 UTC
Created attachment 130503 [details] [review]
Bug 29924: Unit tests

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 28 Owen Leonard 2022-02-11 14:57:31 UTC
Created attachment 130504 [details] [review]
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message

- The atomicupdate didn't have "bug_number" defined.
- The "Your password has expired" message is now styled with the same
  class as other OPAC login messages.
Comment 29 Owen Leonard 2022-02-11 14:57:35 UTC
Created attachment 130505 [details] [review]
Bug 29924: (follow-up) Add password_expiration_date to API

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 30 Nick Clemens 2022-02-14 18:23:03 UTC
Created attachment 130557 [details] [review]
Bug 29924: Database updates

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 31 Nick Clemens 2022-02-14 18:23:07 UTC
Created attachment 130558 [details] [review]
Bug 29924: DO NOT PUSH - Schema updates

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 32 Nick Clemens 2022-02-14 18:23:11 UTC
Created attachment 130559 [details] [review]
Bug 29924: Add password expiration feature

This patch adds the ability to define password_expiry_days for a patron
category.

When defined a patron's password will expire after X days and they will
be required to reset their password. If OPAC resets are enabled for the
catgeory they may do so on their own, otherwise they will need to
contact the library

To test:
 1 - Apply patch, updatedatabase
 2 - Set 'Password expiration' for a patron category
     Home-> Administration-> Patron categories-> Edit
 3 - Create a new patron in this category with a userid/password set,
     and an email
 4 - Confirm their password_expiration_date field is set
     SELECT password_expiration_date FROM borrowers WHERE borrowernumber=51;
 5 - Create a new patron, do not set a password
 6 - Confirm their password_expiration_date field is NULL
 7 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration_date='2022-01-01' WHERE borrowernumber=51;
 8 - Give the borrower catalogue permission
 9 - Attempt to log in to Straff interface
10 - Confirm you are signed out and notified that password must be
     reset
11 - Attempt to sign in to OPAC
12 - Confirm you are signed out and notified password must be reset
13 - Enable password reset for the patron's category and perform a
     password reset
     Note: you will have to find the link in the message_queue unless
     you have emails setup on your test environment
     SELECT * FROM message_queue WHERE borrowernumber=51;
14 - Confirm that you can now sign in and password_expiration_date field
     is set 10 days in the future
15 - Expire the patron's password again
16 - Change the patron's password via the staff interface
17 - Confirm they can sign in and the expiration is updated

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 33 Nick Clemens 2022-02-14 18:23:14 UTC
Created attachment 130560 [details] [review]
Bug 29924: Unit tests

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 34 Nick Clemens 2022-02-14 18:23:18 UTC
Created attachment 130561 [details] [review]
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message

- The atomicupdate didn't have "bug_number" defined.
- The "Your password has expired" message is now styled with the same
  class as other OPAC login messages.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 35 Nick Clemens 2022-02-14 18:23:22 UTC
Created attachment 130562 [details] [review]
Bug 29924: (follow-up) Add password_expiration_date to API

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 36 Nick Clemens 2022-02-14 18:23:25 UTC
Created attachment 130563 [details] [review]
Bug 29924: (follow-up) Adjust test count
Comment 37 Andrew Fuerste-Henry 2022-02-16 17:18:06 UTC
Created attachment 130677 [details] [review]
Bug 29924: Database updates

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 38 Andrew Fuerste-Henry 2022-02-16 17:18:10 UTC
Created attachment 130678 [details] [review]
Bug 29924: DO NOT PUSH - Schema updates

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 39 Andrew Fuerste-Henry 2022-02-16 17:18:15 UTC
Created attachment 130679 [details] [review]
Bug 29924: Add password expiration feature

This patch adds the ability to define password_expiry_days for a patron
category.

When defined a patron's password will expire after X days and they will
be required to reset their password. If OPAC resets are enabled for the
catgeory they may do so on their own, otherwise they will need to
contact the library

To test:
 1 - Apply patch, updatedatabase
 2 - Set 'Password expiration' for a patron category
     Home-> Administration-> Patron categories-> Edit
 3 - Create a new patron in this category with a userid/password set,
     and an email
 4 - Confirm their password_expiration_date field is set
     SELECT password_expiration_date FROM borrowers WHERE borrowernumber=51;
 5 - Create a new patron, do not set a password
 6 - Confirm their password_expiration_date field is NULL
 7 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration_date='2022-01-01' WHERE borrowernumber=51;
 8 - Give the borrower catalogue permission
 9 - Attempt to log in to Straff interface
10 - Confirm you are signed out and notified that password must be
     reset
11 - Attempt to sign in to OPAC
12 - Confirm you are signed out and notified password must be reset
13 - Enable password reset for the patron's category and perform a
     password reset
     Note: you will have to find the link in the message_queue unless
     you have emails setup on your test environment
     SELECT * FROM message_queue WHERE borrowernumber=51;
14 - Confirm that you can now sign in and password_expiration_date field
     is set 10 days in the future
15 - Expire the patron's password again
16 - Change the patron's password via the staff interface
17 - Confirm they can sign in and the expiration is updated

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 40 Andrew Fuerste-Henry 2022-02-16 17:18:19 UTC
Created attachment 130680 [details] [review]
Bug 29924: Unit tests

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 41 Andrew Fuerste-Henry 2022-02-16 17:18:23 UTC
Created attachment 130681 [details] [review]
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message

- The atomicupdate didn't have "bug_number" defined.
- The "Your password has expired" message is now styled with the same
  class as other OPAC login messages.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 42 Andrew Fuerste-Henry 2022-02-16 17:18:29 UTC
Created attachment 130682 [details] [review]
Bug 29924: (follow-up) Add password_expiration_date to API

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 43 Andrew Fuerste-Henry 2022-02-16 17:18:34 UTC
Created attachment 130683 [details] [review]
Bug 29924: (follow-up) Adjust test count

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 44 Nick Clemens 2022-02-25 18:46:42 UTC
Created attachment 131128 [details] [review]
Bug 29924: (follow-up) Add default value undef for TestBuilder
Comment 45 Nick Clemens 2022-03-23 16:00:57 UTC
Created attachment 132059 [details] [review]
Bug 29924: Database updates

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 46 Nick Clemens 2022-03-23 16:01:02 UTC
Created attachment 132060 [details] [review]
Bug 29924: Add password expiration feature

This patch adds the ability to define password_expiry_days for a patron
category.

When defined a patron's password will expire after X days and they will
be required to reset their password. If OPAC resets are enabled for the
catgeory they may do so on their own, otherwise they will need to
contact the library

To test:
 1 - Apply patch, updatedatabase
 2 - Set 'Password expiration' for a patron category
     Home-> Administration-> Patron categories-> Edit
 3 - Create a new patron in this category with a userid/password set,
     and an email
 4 - Confirm their password_expiration_date field is set
     SELECT password_expiration_date FROM borrowers WHERE borrowernumber=51;
 5 - Create a new patron, do not set a password
 6 - Confirm their password_expiration_date field is NULL
 7 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration_date='2022-01-01' WHERE borrowernumber=51;
 8 - Give the borrower catalogue permission
 9 - Attempt to log in to Straff interface
10 - Confirm you are signed out and notified that password must be
     reset
11 - Attempt to sign in to OPAC
12 - Confirm you are signed out and notified password must be reset
13 - Enable password reset for the patron's category and perform a
     password reset
     Note: you will have to find the link in the message_queue unless
     you have emails setup on your test environment
     SELECT * FROM message_queue WHERE borrowernumber=51;
14 - Confirm that you can now sign in and password_expiration_date field
     is set 10 days in the future
15 - Expire the patron's password again
16 - Change the patron's password via the staff interface
17 - Confirm they can sign in and the expiration is updated

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 47 Nick Clemens 2022-03-23 16:01:06 UTC
Created attachment 132061 [details] [review]
Bug 29924: Unit tests

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 48 Nick Clemens 2022-03-23 16:01:10 UTC
Created attachment 132062 [details] [review]
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message

- The atomicupdate didn't have "bug_number" defined.
- The "Your password has expired" message is now styled with the same
  class as other OPAC login messages.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 49 Nick Clemens 2022-03-23 16:01:14 UTC
Created attachment 132063 [details] [review]
Bug 29924: (follow-up) Add password_expiration_date to API

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Comment 50 Nick Clemens 2022-03-23 16:01:18 UTC
Created attachment 132064 [details] [review]
Bug 29924: (follow-up) Add default value undef for TestBuilder
Comment 51 Nick Clemens 2022-03-23 16:01:22 UTC
Created attachment 132065 [details] [review]
Bug 29924: DO NOT PUSH - Schema updates
Comment 52 Nick Clemens 2022-03-23 16:01:26 UTC
Created attachment 132066 [details] [review]
Bug 29924: Update ILSDI to be aware of expired passwords

To test:
1 - Enable ILSDI
2 - Set a patron password with expired password
3 - http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=AuthenticatePatron&username=usernam&password=password
4 - Confirm 'PasswordExpired' returned
Comment 53 Nick Clemens 2022-03-23 20:29:59 UTC
Created attachment 132084 [details] [review]
Bug 29924: Update ILSDI to be aware of expired passwords

To test:
1 - Enable ILSDI
2 - Set a patron password with expired password
3 - http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=AuthenticatePatron&username=usernam&password=password
4 - Confirm 'PasswordExpired' returned
Comment 54 Andrew Fuerste-Henry 2022-03-23 21:02:28 UTC
Created attachment 132085 [details] [review]
Bug 29924: Database updates

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 55 Andrew Fuerste-Henry 2022-03-23 21:02:32 UTC
Created attachment 132086 [details] [review]
Bug 29924: Add password expiration feature

This patch adds the ability to define password_expiry_days for a patron
category.

When defined a patron's password will expire after X days and they will
be required to reset their password. If OPAC resets are enabled for the
catgeory they may do so on their own, otherwise they will need to
contact the library

To test:
 1 - Apply patch, updatedatabase
 2 - Set 'Password expiration' for a patron category
     Home-> Administration-> Patron categories-> Edit
 3 - Create a new patron in this category with a userid/password set,
     and an email
 4 - Confirm their password_expiration_date field is set
     SELECT password_expiration_date FROM borrowers WHERE borrowernumber=51;
 5 - Create a new patron, do not set a password
 6 - Confirm their password_expiration_date field is NULL
 7 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration_date='2022-01-01' WHERE borrowernumber=51;
 8 - Give the borrower catalogue permission
 9 - Attempt to log in to Straff interface
10 - Confirm you are signed out and notified that password must be
     reset
11 - Attempt to sign in to OPAC
12 - Confirm you are signed out and notified password must be reset
13 - Enable password reset for the patron's category and perform a
     password reset
     Note: you will have to find the link in the message_queue unless
     you have emails setup on your test environment
     SELECT * FROM message_queue WHERE borrowernumber=51;
14 - Confirm that you can now sign in and password_expiration_date field
     is set 10 days in the future
15 - Expire the patron's password again
16 - Change the patron's password via the staff interface
17 - Confirm they can sign in and the expiration is updated

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 56 Andrew Fuerste-Henry 2022-03-23 21:02:39 UTC
Created attachment 132087 [details] [review]
Bug 29924: Unit tests

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 57 Andrew Fuerste-Henry 2022-03-23 21:02:45 UTC
Created attachment 132088 [details] [review]
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message

- The atomicupdate didn't have "bug_number" defined.
- The "Your password has expired" message is now styled with the same
  class as other OPAC login messages.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 58 Andrew Fuerste-Henry 2022-03-23 21:02:50 UTC
Created attachment 132089 [details] [review]
Bug 29924: (follow-up) Add password_expiration_date to API

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 59 Andrew Fuerste-Henry 2022-03-23 21:02:56 UTC
Created attachment 132090 [details] [review]
Bug 29924: (follow-up) Add default value undef for TestBuilder

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 60 Andrew Fuerste-Henry 2022-03-23 21:03:01 UTC
Created attachment 132091 [details] [review]
Bug 29924: DO NOT PUSH - Schema updates

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 61 Andrew Fuerste-Henry 2022-03-23 21:03:06 UTC
Created attachment 132092 [details] [review]
Bug 29924: Update ILSDI to be aware of expired passwords

To test:
1 - Enable ILSDI
2 - Set a patron password with expired password
3 - http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=AuthenticatePatron&username=usernam&password=password
4 - Confirm 'PasswordExpired' returned

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 62 Tomás Cohen Arazi 2022-04-21 17:14:38 UTC
Nick, do you *need* the password expiration on the API response? Can we remove it and have a separate route for dealing with that? It will become tricky with security, and also in light of the discussion on bug 28786 and friends, I think we should expose it in some other way if required.
Comment 63 Tomás Cohen Arazi 2022-04-23 12:32:42 UTC
Please rebase.
Comment 64 Martin Renvoize 2022-04-25 08:46:14 UTC
Also interesting in testing this once rebased :)
Comment 65 Nick Clemens 2022-04-25 11:32:34 UTC
Created attachment 133741 [details] [review]
Bug 29924: Database updates

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 66 Nick Clemens 2022-04-25 11:32:39 UTC
Created attachment 133742 [details] [review]
Bug 29924: Add password expiration feature

This patch adds the ability to define password_expiry_days for a patron
category.

When defined a patron's password will expire after X days and they will
be required to reset their password. If OPAC resets are enabled for the
catgeory they may do so on their own, otherwise they will need to
contact the library

To test:
 1 - Apply patch, updatedatabase
 2 - Set 'Password expiration' for a patron category
     Home-> Administration-> Patron categories-> Edit
 3 - Create a new patron in this category with a userid/password set,
     and an email
 4 - Confirm their password_expiration_date field is set
     SELECT password_expiration_date FROM borrowers WHERE borrowernumber=51;
 5 - Create a new patron, do not set a password
 6 - Confirm their password_expiration_date field is NULL
 7 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration_date='2022-01-01' WHERE borrowernumber=51;
 8 - Give the borrower catalogue permission
 9 - Attempt to log in to Straff interface
10 - Confirm you are signed out and notified that password must be
     reset
11 - Attempt to sign in to OPAC
12 - Confirm you are signed out and notified password must be reset
13 - Enable password reset for the patron's category and perform a
     password reset
     Note: you will have to find the link in the message_queue unless
     you have emails setup on your test environment
     SELECT * FROM message_queue WHERE borrowernumber=51;
14 - Confirm that you can now sign in and password_expiration_date field
     is set 10 days in the future
15 - Expire the patron's password again
16 - Change the patron's password via the staff interface
17 - Confirm they can sign in and the expiration is updated

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 67 Nick Clemens 2022-04-25 11:32:44 UTC
Created attachment 133743 [details] [review]
Bug 29924: Unit tests

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 68 Nick Clemens 2022-04-25 11:32:48 UTC
Created attachment 133744 [details] [review]
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message

- The atomicupdate didn't have "bug_number" defined.
- The "Your password has expired" message is now styled with the same
  class as other OPAC login messages.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 69 Nick Clemens 2022-04-25 11:32:53 UTC
Created attachment 133745 [details] [review]
Bug 29924: (follow-up) Add password_expiration_date to API

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 70 Nick Clemens 2022-04-25 11:32:57 UTC
Created attachment 133746 [details] [review]
Bug 29924: (follow-up) Add default value undef for TestBuilder

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 71 Nick Clemens 2022-04-25 11:33:03 UTC
Created attachment 133747 [details] [review]
Bug 29924: Update ILSDI to be aware of expired passwords

To test:
1 - Enable ILSDI
2 - Set a patron password with expired password
3 - http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=AuthenticatePatron&username=usernam&password=password
4 - Confirm 'PasswordExpired' returned

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Comment 72 Nick Clemens 2022-04-25 11:33:08 UTC
Created attachment 133748 [details] [review]
Bug 29924: DO NOT PUSH - Schema updates
Comment 73 Tomás Cohen Arazi 2022-04-25 14:29:05 UTC
Created attachment 133801 [details] [review]
Bug 29924: Database updates

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 74 Tomás Cohen Arazi 2022-04-25 14:29:34 UTC
Created attachment 133802 [details] [review]
Bug 29924: Add password expiration feature

This patch adds the ability to define password_expiry_days for a patron
category.

When defined a patron's password will expire after X days and they will
be required to reset their password. If OPAC resets are enabled for the
catgeory they may do so on their own, otherwise they will need to
contact the library

To test:
 1 - Apply patch, updatedatabase
 2 - Set 'Password expiration' for a patron category
     Home-> Administration-> Patron categories-> Edit
 3 - Create a new patron in this category with a userid/password set,
     and an email
 4 - Confirm their password_expiration_date field is set
     SELECT password_expiration_date FROM borrowers WHERE borrowernumber=51;
 5 - Create a new patron, do not set a password
 6 - Confirm their password_expiration_date field is NULL
 7 - Update the patron with an expiration to be expired
     UPDATE borrowers SET password_expiration_date='2022-01-01' WHERE borrowernumber=51;
 8 - Give the borrower catalogue permission
 9 - Attempt to log in to Straff interface
10 - Confirm you are signed out and notified that password must be
     reset
11 - Attempt to sign in to OPAC
12 - Confirm you are signed out and notified password must be reset
13 - Enable password reset for the patron's category and perform a
     password reset
     Note: you will have to find the link in the message_queue unless
     you have emails setup on your test environment
     SELECT * FROM message_queue WHERE borrowernumber=51;
14 - Confirm that you can now sign in and password_expiration_date field
     is set 10 days in the future
15 - Expire the patron's password again
16 - Change the patron's password via the staff interface
17 - Confirm they can sign in and the expiration is updated

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 75 Tomás Cohen Arazi 2022-04-25 14:30:01 UTC
Created attachment 133803 [details] [review]
Bug 29924: Unit tests

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 76 Tomás Cohen Arazi 2022-04-25 14:30:40 UTC
Created attachment 133804 [details] [review]
Bug 29924: (follow-up) Add bug number to atomicupdate; Style OPAC message

- The atomicupdate didn't have "bug_number" defined.
- The "Your password has expired" message is now styled with the same
  class as other OPAC login messages.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 77 Tomás Cohen Arazi 2022-04-25 14:31:17 UTC
Created attachment 133805 [details] [review]
Bug 29924: (follow-up) Add password_expiration_date to API

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 78 Tomás Cohen Arazi 2022-04-25 14:31:40 UTC
Created attachment 133806 [details] [review]
Bug 29924: (follow-up) Add default value undef for TestBuilder

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 79 Tomás Cohen Arazi 2022-04-25 14:32:02 UTC
Created attachment 133807 [details] [review]
Bug 29924: Update ILSDI to be aware of expired passwords

To test:
1 - Enable ILSDI
2 - Set a patron password with expired password
3 - http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=AuthenticatePatron&username=usernam&password=password
4 - Confirm 'PasswordExpired' returned

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 80 Tomás Cohen Arazi 2022-04-25 14:32:35 UTC
Created attachment 133808 [details] [review]
Bug 29924: DO NOT PUSH - Schema updates

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 81 Tomás Cohen Arazi 2022-04-25 14:32:57 UTC
Created attachment 133809 [details] [review]
Bug 29924: (QA follow-up) Remove password_expiration_date from API

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 82 Tomás Cohen Arazi 2022-04-25 14:33:24 UTC
Created attachment 133810 [details] [review]
Bug 29924: Add tests for API Basic auth behavior

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 83 Tomás Cohen Arazi 2022-04-26 18:08:34 UTC
Created attachment 133989 [details] [review]
Bug 29924: Avoid leaking information on wrong credentials

If the passed credentials are wrong, we shouldn't expose things like the
password is expired.

This patch takes care of that.

To test:
1. Have a known patron with password_expiration_date set so its
   password is expired. Can be done like:
   $ koha-mysql kohadev
   > UPDATE borrowers \
     SET password_expiration_date='2022-04-25' \
     WHERE borrowernumber=132;
   Note: change the borrowernumber
2. Attempt to login to the OPAC with wrong credentials
=> SUCCESS: You are rejected, with a message telling credentials are
            wrong
=> FAIL: You are told the password is expired.
3. Apply this patch and restart Plack
4. Repeat 2
=> SUCCESS: You are rejected, credentials are wrong and no mention to
            password being expired.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 84 Fridolin Somers 2022-05-05 21:58:05 UTC
Great new feature.
Sorry it is too short to be in 22.05 release.
Will be in good hands during next cycle :D
Comment 85 Fridolin Somers 2022-05-06 19:42:16 UTC
Created attachment 134758 [details] [review]
Bug 29924: (follow-up) Fix t/db_dependent/Koha/Patron.t number of tests
Comment 86 Fridolin Somers 2022-05-06 19:43:13 UTC
(In reply to Fridolin Somers from comment #84)
> Great new feature.
> Sorry it is too short to be in 22.05 release.
> Will be in good hands during next cycle :D

I've been asked to reconsider.
Since it applies and is by default disabled I change my mind and push ;)
Comment 87 Fridolin Somers 2022-05-06 20:34:08 UTC
Pushed to master for 22.05, thanks to everybody involved 🦄