Bug 31050 - Standardize session setup
Summary: Standardize session setup
Status: REOPENED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
: 28507 (view as bug list)
Depends on:
Blocks:
 
Reported: 2022-06-27 03:43 UTC by David Cook
Modified: 2023-06-02 03:25 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 31050: C4::Context->setup_session() standardizes user session setup (10.48 KB, patch)
2022-06-27 06:25 UTC, David Cook
Details | Diff | Splinter Review
Bug 31050: C4::Context->setup_session() standardizes user session setup (10.55 KB, patch)
2022-07-22 08:23 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2022-06-27 03:43:24 UTC
We should have 1 function that sets up the basics of a $session object which we can use across all our different authentication options.
Comment 1 David Cook 2022-06-27 06:25:11 UTC
Created attachment 136566 [details] [review]
Bug 31050: C4::Context->setup_session() standardizes user session setup

Test plan:
0. Apply patch and koha-plack --restart kohadev
1. Log into http://localhost:8081/cgi-bin/koha/mainpage.pl using "koha" user
2. Note the login is successful

3. koha-mysql kohadev
3a. select * from sessions;
Session in MySQL sets parameters like surname, flags, interface, ip, lasttime, etc
3b. select * from systempreferences where variable = 'Version';
3c. update systempreferences set value = '<version which is 1 number less at the end>' where variable = 'Version';

4. koha-plack --restart kohadev
5. echo 'flush_all' | nc -q 1 memcached 11211

6. Visit http://localhost:8081/ and do the upgrade
6b. Note that the authentication and upgrade works without a problem

7. curl http://localhost:8081/cgi-bin/koha/svc/authentication -d 'userid=<koha user>&password=<koha password>'

8. koha-mysql kohadev
8a. select * from sessions;
Session in MySQL sets parameters like surname, flags, interface, ip, lasttime, etc
Comment 2 David Cook 2022-06-27 06:34:06 UTC
As an aside, this would make it easier to write authentication extensions.

Here is an example where the user is logged in with a new user session by supplying their cardnumber.

use Modern::Perl;
use CGI qw ( -utf8 );
use C4::Context;
my $query = CGI->new;
my $cardnumber = $query->param('cardnumber');
my $user = Koha::Patrons->find({ cardnumber => $cardnumber });
if ($user){
    my $session = C4::Auth::get_session();
    my $branch = $user->library;
    C4::Context->setup_session({
        session => $session,
        data => {
            'number',       $user->borrowernumber,
            'id',           $user->userid,
            'cardnumber',   $user->cardnumber,
            'firstname',    $user->firstname,
            'surname',      $user->surname,
            'branch',       $branch->branchcode,
            'branchname',   $branch->branchname,
            'flags',        $user->flags,
            'emailaddress', $user->email,
            'interface',    'opac',
        },
    });
    my $cookie = $query->cookie(
        -name     => 'CGISESSID',
        -value    => $session->id,
        -HttpOnly => 1,
        -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
        -sameSite => 'Lax'
    );
    print $query->redirect(
        -uri => '/cgi-bin/koha/opac-main.pl',
        -cookie => $cookie,
    );
}
Comment 3 David Cook 2022-06-27 06:45:45 UTC
*** Bug 28507 has been marked as a duplicate of this bug. ***
Comment 4 Martin Renvoize 2022-07-22 08:23:03 UTC
Created attachment 138003 [details] [review]
Bug 31050: C4::Context->setup_session() standardizes user session setup

Test plan:
0. Apply patch and koha-plack --restart kohadev
1. Log into http://localhost:8081/cgi-bin/koha/mainpage.pl using "koha" user
2. Note the login is successful

3. koha-mysql kohadev
3a. select * from sessions;
Session in MySQL sets parameters like surname, flags, interface, ip, lasttime, etc
3b. select * from systempreferences where variable = 'Version';
3c. update systempreferences set value = '<version which is 1 number less at the end>' where variable = 'Version';

4. koha-plack --restart kohadev
5. echo 'flush_all' | nc -q 1 memcached 11211

6. Visit http://localhost:8081/ and do the upgrade
6b. Note that the authentication and upgrade works without a problem

7. curl http://localhost:8081/cgi-bin/koha/svc/authentication -d 'userid=<koha user>&password=<koha password>'

8. koha-mysql kohadev
8a. select * from sessions;
Session in MySQL sets parameters like surname, flags, interface, ip, lasttime, etc

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Martin Renvoize 2022-07-22 08:24:03 UTC
This is a nice bit of code cleaning, thanks David.. as you suggested, it might be nice as a next step to allow just passing a Patron object and then constructing the various fields from that.. could have a nice reduction in line count again.

Signing off.
Comment 6 Jonathan Druart 2022-08-01 11:02:55 UTC
New method, new tests, please.
Comment 7 David Cook 2023-06-02 03:24:08 UTC
Bug 32178 implements enough of the functionality to close out this one I think

*** This bug has been marked as a duplicate of bug 32178 ***
Comment 8 David Cook 2023-06-02 03:25:19 UTC
Then again... C4::Auth::create_basic_session() is only used for the OIDC auth, so I guess we still do have a ways to go...

But I don't think I'll be working on it any time soon.