Bug 36197 - Allow unauthenticated ILL requests in the OPAC
Summary: Allow unauthenticated ILL requests in the OPAC
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: ILL (show other bugs)
Version: Main
Hardware: All All
: P5 - low new feature
Assignee: Pedro Amorim
QA Contact: Tomás Cohen Arazi (tcohen)
URL: https://github.com/PTFS-Europe/koha/c...
Keywords: roadmap_24_05, roadmap_24_11
Depends on: 35604
Blocks: 38441 39092 39697 39774 39918 39786
  Show dependency treegraph
 
Reported: 2024-02-28 16:44 UTC by Pedro Amorim
Modified: 2025-05-16 15:18 UTC (History)
11 users (show)

See Also:
GIT URL:
Change sponsored?: Sponsored
Patch complexity: Medium patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
This new feature adds the option for unauthenticated users to place ILL requests through the OPAC without needing to log in. This may be especially helpful if users are redirected to the Koha OPAC ILL request form from an external service, allowing them to access the request form directly without being prompted to log in.
Version(s) released in:
25.05.00
Circulation function:


Attachments
Bug 36197: Add ILLOpacUnauthenticatedRequest sys pref (3.29 KB, patch)
2024-09-12 09:34 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add opac_unauthenticated_ill_requests backend capability to 'Standard' backend (981 bytes, patch)
2024-09-12 09:34 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Consider unauthenticated_ill in 'Standard' create form (2.83 KB, patch)
2024-09-12 09:34 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Refactor -> opac_available_backends method (2.56 KB, patch)
2024-09-12 09:34 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add UNAUTH Standard request status (1.51 KB, patch)
2024-09-12 09:34 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Update how form params are validated (5.58 KB, patch)
2024-09-12 09:34 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Update how the request is added: (2.33 KB, patch)
2024-09-12 09:34 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Only check limits for regular requests (1.36 KB, patch)
2024-09-12 09:34 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: OPAC unauthenticated screen (5.76 KB, patch)
2024-09-12 09:35 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Make authentication not required if conditions are met (1.65 KB, patch)
2024-09-12 09:35 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Unauthenticated patron can always place ILL request if ILLOpacUnauthenticatedRequest (1.05 KB, patch)
2024-09-12 09:35 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Only add cardnumber info to request is a user is logged in (1.10 KB, patch)
2024-09-12 09:35 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: OPAC 'Make an ILL request' link (2.31 KB, patch)
2024-09-12 09:35 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add tests (13.20 KB, patch)
2024-09-12 09:35 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add ILLOpacUnauthenticatedRequest sys pref (3.29 KB, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add opac_unauthenticated_ill_requests backend capability to 'Standard' backend (981 bytes, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Consider unauthenticated_ill in 'Standard' create form (2.85 KB, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Refactor -> opac_available_backends method (2.56 KB, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add UNAUTH Standard request status (1.51 KB, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Update how form params are validated (5.59 KB, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Update how the request is added: (2.33 KB, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Only check limits for regular requests (1.36 KB, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: OPAC unauthenticated screen (5.76 KB, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Make authentication not required if conditions are met (1.65 KB, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Unauthenticated patron can always place ILL request if ILLOpacUnauthenticatedRequest (1.05 KB, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Only add cardnumber info to request is a user is logged in (1.10 KB, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: OPAC 'Make an ILL request' link (2.31 KB, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add tests (13.20 KB, patch)
2024-11-14 11:37 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Fix testcritic.t (889 bytes, patch)
2025-01-15 12:39 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Fix PluginRoutes.t (1.17 KB, patch)
2025-01-15 13:11 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Make ConfirmAuto::get_priority_backends respect opac_available_backends if OPAC (2.07 KB, patch)
2025-01-16 15:52 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Fix backends filtering in opac_available_backends (1.34 KB, patch)
2025-01-17 12:04 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Pass the filtered OPAC backends to OPAC template (1.06 KB, patch)
2025-01-17 12:04 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Move unauthenticated_notes to core (2.69 KB, patch)
2025-01-17 13:03 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Move unauth_request_data_check to core (2.83 KB, patch)
2025-01-17 13:12 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add ILLOpacUnauthenticatedRequest sys pref (3.31 KB, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add opac_unauthenticated_ill_requests backend capability to 'Standard' backend (983 bytes, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Consider unauthenticated_ill in 'Standard' create form (2.90 KB, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Refactor -> opac_available_backends method (2.61 KB, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add UNAUTH Standard request status (1.52 KB, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Update how form params are validated (5.60 KB, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Update how the request is added: (2.43 KB, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Only check limits for regular requests (1.31 KB, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: OPAC unauthenticated screen (5.77 KB, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Make authentication not required if conditions are met (1.84 KB, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Unauthenticated patron can always place ILL request if ILLOpacUnauthenticatedRequest (1.05 KB, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Only add cardnumber info to request is a user is logged in (1.10 KB, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: OPAC 'Make an ILL request' link (2.16 KB, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add tests (13.50 KB, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Fix testcritic.t (970 bytes, patch)
2025-03-27 12:17 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Fix PluginRoutes.t (1.18 KB, patch)
2025-03-27 12:18 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Make ConfirmAuto::get_priority_backends respect opac_available_backends if OPAC (2.07 KB, patch)
2025-03-27 12:18 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Fix backends filtering in opac_available_backends (1.38 KB, patch)
2025-03-27 12:18 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Pass the filtered OPAC backends to OPAC template (1.17 KB, patch)
2025-03-27 12:18 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Move unauthenticated_notes to core (2.69 KB, patch)
2025-03-27 12:18 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Move unauth_request_data_check to core (2.83 KB, patch)
2025-03-27 12:18 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add ILLOpacUnauthenticatedRequest sys pref (3.31 KB, patch)
2025-04-11 14:22 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add opac_unauthenticated_ill_requests backend capability to 'Standard' backend (983 bytes, patch)
2025-04-11 14:22 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Consider unauthenticated_ill in 'Standard' create form (2.90 KB, patch)
2025-04-11 14:22 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Refactor -> opac_available_backends method (2.29 KB, patch)
2025-04-11 14:22 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add UNAUTH Standard request status (1.52 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Update how form params are validated (5.60 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Update how the request is added: (2.43 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Only check limits for regular requests (1.31 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: OPAC unauthenticated screen (5.77 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Make authentication not required if conditions are met (1.84 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Unauthenticated patron can always place ILL request if ILLOpacUnauthenticatedRequest (1.05 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Only add cardnumber info to request is a user is logged in (1.10 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: OPAC 'Make an ILL request' link (2.16 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add tests (13.30 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Fix testcritic.t (970 bytes, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Fix PluginRoutes.t (1.18 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Make ConfirmAuto::get_priority_backends respect opac_available_backends if OPAC (2.08 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Fix backends filtering in opac_available_backends (1.44 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Pass the filtered OPAC backends to OPAC template (1.17 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Move unauthenticated_notes to core (2.69 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Move unauth_request_data_check to core (2.83 KB, patch)
2025-04-11 14:23 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Hackfest followup WIP (8.43 KB, patch)
2025-04-11 14:24 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Add public form captcha (5.97 KB, patch)
2025-04-11 14:24 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Adopt POST REDIRECT GET pattern (15.97 KB, patch)
2025-04-11 14:24 UTC, Pedro Amorim
Details | Diff | Splinter Review
Bug 36197: Add ILLOpacUnauthenticatedRequest sys pref (3.36 KB, patch)
2025-04-17 13:39 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: Add opac_unauthenticated_ill_requests backend capability to 'Standard' backend (1.01 KB, patch)
2025-04-17 13:39 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: Consider unauthenticated_ill in 'Standard' create form (2.96 KB, patch)
2025-04-17 13:39 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: Refactor -> opac_available_backends method (2.35 KB, patch)
2025-04-17 13:39 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: Add UNAUTH Standard request status (1.57 KB, patch)
2025-04-17 13:39 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: Update how form params are validated (5.65 KB, patch)
2025-04-17 13:39 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: Update how the request is added: (2.49 KB, patch)
2025-04-17 13:39 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: Only check limits for regular requests (1.37 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: OPAC unauthenticated screen (5.82 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: Make authentication not required if conditions are met (1.90 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: Unauthenticated patron can always place ILL request if ILLOpacUnauthenticatedRequest (1.11 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: Only add cardnumber info to request is a user is logged in (1.16 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: OPAC 'Make an ILL request' link (2.21 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: Add tests (13.36 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Fix testcritic.t (1.00 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Fix PluginRoutes.t (1.23 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Make ConfirmAuto::get_priority_backends respect opac_available_backends if OPAC (2.13 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Fix backends filtering in opac_available_backends (1.50 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Pass the filtered OPAC backends to OPAC template (1.22 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Move unauthenticated_notes to core (2.74 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Move unauth_request_data_check to core (2.89 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Hackfest followup WIP (8.49 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Add public form captcha (6.03 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Adopt POST REDIRECT GET pattern (16.02 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: Atomic update style update (1.30 KB, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: Remove incorrect import (758 bytes, patch)
2025-04-17 13:40 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36197: (QA follow-up): Update terminology: (4.26 KB, patch)
2025-04-28 12:10 UTC, Pedro Amorim
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Pedro Amorim 2024-02-28 16:44:38 UTC

    
Comment 1 Pedro Amorim 2024-04-24 14:34:01 UTC Comment hidden (obsolete)
Comment 2 Pedro Amorim 2024-05-17 14:09:19 UTC
This is ready for testing. Branch at:
https://github.com/PTFS-Europe/koha/commits/b_36197

0) If k-t-d, run updatedatabase (ignore this if testing on a sandbox)
1) Enable ILLModule syspref:
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModule
2) No need to install a backend as 35570 is in the tree
3) On a different browser session, without being lgoged in, access the create ILL request OPAC page directly:
  {opac_url}/cgi-bin/koha/opac-illrequests.pl?method=create&backend=Standard
4) Notice you're presented with the login page, as expected
5) Enable ILLOpacUnauthenticatedRequest:
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLOpacUnauthenticatedRequest
6) Repeat step 3) Notice you now get the create ILL request form, with some additional inputs at the top specific to an unauthenticated request (first name, last name, e-mail address)
6.5) (optional) Confirm the 'Make an Interlibrary loan request' link exists at the bottom of the search results page, while unauthenticated on OPAC:
  {opac_url}/cgi-bin/koha/opac-search.pl?idx=&q=music&weight_search=1
  This should only show for authenticated OPAC users if ILLOpacUnauthenticatedRequest is off.
7) Test the form, try submitting with some blank fields, change type and library after and before inputing data in the input fields, etc.
8) Submit the form successfully. Notice you're presented with the unauthenticated request submission confirmation screen with a message and request details.
9) Go back to Staff UI, logged in, access ILL requests and confirm the unauthenticated request submitted through the OPAC is there:
  {staff_url}/cgi-bin/koha/ill/ill-requests.pl
10) Test that you can add a patron afterwards, if needed, by clicking 'Edit request' on the toolbar of the manage request page, and entering a patron ID
11) Test that you're able to 'confirm' the request by clicking 'Confirm request', as if it was a regular 'NEW' request.

Additional testing:
 Make sure existing ILL functionality interacts with this new optional workflow behavior.
 For this, we're using ILLModuleDisclaimerByType. ILLCheckAvailability or AutoILLBackendPriority can also be used but require more setup (plugins, credentials, etc)
1) Configure ILLModuleDisclaimerByType, visit
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModuleDisclaimerByType
2) Click the 'edit' link at the bottom of the syspref and copy the example code from the description into the text box. Save.
3) Repeat the original test plan from above, but make sure the request type is not 'article' (as that type is bypassed). Use 'journal', for example. Submit the request making sure you fill in all mandatory fields.
4) Notice you're now presented with the ILL request disclaimer screen, hit Submit. Notice the request is created as before.
5) Return to Staff UI, logged in, confirm this 2nd unauthenticated request has been created and the type disclaimer info is stored and presented when viewing the request.

Run tests (k-t-d only):
  prove t/db_dependent/Koha/ILL/Backends.t
  prove t/db_dependent/selenium/opac_ill_requests.t

Sponsored-by: NHS England (National Health Service England)
Comment 3 David Nind 2024-05-20 04:08:54 UTC
I had a go at testing. I haven't signed off yet, mainly because of the error noted in note 5.

Notes from testing (using KTD):

1. Step 8: When you submit the request for type 'Book' (when unauthenticated) and visit the link, you go to a newly created record. This is discoverable by searching. None of the other types creates a record.

2. Additional testing - step 3: I only tested with ILLModuleDisclaimerByType. I don't get a type of 'article', but I think that is the code for 'Journal article'? I get Book, Chapter, Journal, Journal article, Thesis, Conference, DVD, Other, Generic resource.

3. On the input form, compulsory fields have an asterisk after the field label, but nothing to say that these are mandatory (that is, an explanation for the *). When you submit without completing a mandatory field, a plain text message appears at the top. This is different from the "normal" way of presenting forms in the OPAC, but I think you are aware of that 8-).

4. Before or after submitting the form when unauthenticated, the breadcrumb link ('Interlibrary loan requests') comes up with the 'Login to your account' form.

5. If request type is DVD, I get an error trace:

   Template process failed: file error - /kohadevbox/koha/Koha/ILL/Backend/shared-includes/forms/dvd.inc: not found at /kohadevbox/koha/C4/Templates.pm line 134

    in C4::Templates::output at /kohadevbox/koha/C4/Templates.pm line 134
    ....

6. If the request type is Other, there are no additional fields to complete (you can add custom fields).

7. Tests pass. Note: need to start up KTD with Selenium (ktd --selenium up).
Comment 4 Pedro Amorim 2024-05-21 08:41:01 UTC
Hi David, great testing as usual thank you so much.
1) Good point. This is default behavior (for book type) that precedes this work. I'm open to suggestions but have kept this unchanged for now.
2) Correct, 'article' is the code for 'Journal article'
3) Fair points about the form / required fields. As before, I'm open to suggestions but this is default behavior that precedes this work so I've not addressed this here.
4) Thanks for this, will look for providing a follow-up for it.
5) The DVD error, I believe is unrelated to this development and comes from the original commit that added it:
https://github.com/PTFS-Europe/koha-ill-freeform/commit/9d735a2dce267d67b4396a0a33d7cb9521a1dfbe
I believe a required shared-includes/forms/dvd.inc is missing here. I've added Lucas in case he wishes/is available to provide a follow-up here.
6) For the 'other' request type, having no input fields is expected I believe as there's no way what 'other' would have as input hence only considering the custom fields.
Comment 5 David Nind 2024-05-23 06:14:28 UTC
(In reply to Pedro Amorim from comment #4)
> Hi David, great testing as usual thank you so much.
> 1) Good point. This is default behavior (for book type) that precedes this
> work. I'm open to suggestions but have kept this unchanged for now.
> 2) Correct, 'article' is the code for 'Journal article'
> 3) Fair points about the form / required fields. As before, I'm open to
> suggestions but this is default behavior that precedes this work so I've not
> addressed this here.
> 4) Thanks for this, will look for providing a follow-up for it.
> 5) The DVD error, I believe is unrelated to this development and comes from
> the original commit that added it:
> https://github.com/PTFS-Europe/koha-ill-freeform/commit/
> 9d735a2dce267d67b4396a0a33d7cb9521a1dfbe
> I believe a required shared-includes/forms/dvd.inc is missing here. I've
> added Lucas in case he wishes/is available to provide a follow-up here.
> 6) For the 'other' request type, having no input fields is expected I
> believe as there's no way what 'other' would have as input hence only
> considering the custom fields.

Thanks Pedro!

Please add my sign off to the bug.
Comment 6 Pedro Amorim 2024-05-27 14:32:31 UTC
Signed-off-by: David Nind <david@davidnind.com>
Comment 7 Pedro Amorim 2024-09-12 09:34:36 UTC
Created attachment 171358 [details] [review]
Bug 36197: Add ILLOpacUnauthenticatedRequest sys pref

Signed-off-by: David Nind <david@davidnind.com>
Comment 8 Pedro Amorim 2024-09-12 09:34:39 UTC
Created attachment 171359 [details] [review]
Bug 36197: Add opac_unauthenticated_ill_requests backend capability to 'Standard' backend

Signed-off-by: David Nind <david@davidnind.com>
Comment 9 Pedro Amorim 2024-09-12 09:34:42 UTC
Created attachment 171360 [details] [review]
Bug 36197: Consider unauthenticated_ill in 'Standard' create form

This also makes sure an empty left side bar exists for opac unauthenticated screens

Signed-off-by: David Nind <david@davidnind.com>
Comment 10 Pedro Amorim 2024-09-12 09:34:45 UTC
Created attachment 171361 [details] [review]
Bug 36197: Refactor -> opac_available_backends method

Signed-off-by: David Nind <david@davidnind.com>
Comment 11 Pedro Amorim 2024-09-12 09:34:48 UTC
Created attachment 171362 [details] [review]
Bug 36197: Add UNAUTH Standard request status

Assign this new UNAUTH status for unauthenticated requests

Signed-off-by: David Nind <david@davidnind.com>
Comment 12 Pedro Amorim 2024-09-12 09:34:51 UTC
Created attachment 171363 [details] [review]
Bug 36197: Update how form params are validated

Validating an unauth request form requires checking for unauth info
fields.
Validating a regular authenticated request requires checking for
borrower information.

Signed-off-by: David Nind <david@davidnind.com>
Comment 13 Pedro Amorim 2024-09-12 09:34:54 UTC
Created attachment 171364 [details] [review]
Bug 36197: Update how the request is added:

- Do not validate borrower if its an unauthenticated request
- Set borrowernumber to null if its an unauthenticated request
- Add staff and OPAC notes with unauthenticated request info

Signed-off-by: David Nind <david@davidnind.com>
Comment 14 Pedro Amorim 2024-09-12 09:34:57 UTC
Created attachment 171365 [details] [review]
Bug 36197: Only check limits for regular requests

Skip for unauthenticated requests

Signed-off-by: David Nind <david@davidnind.com>
Comment 15 Pedro Amorim 2024-09-12 09:35:00 UTC
Created attachment 171366 [details] [review]
Bug 36197: OPAC unauthenticated screen

unauth_view to show request details after its been submitted

Signed-off-by: David Nind <david@davidnind.com>
Comment 16 Pedro Amorim 2024-09-12 09:35:03 UTC
Created attachment 171367 [details] [review]
Bug 36197: Make authentication not required if conditions are met

/cgi-bin/koha/opac-illrequests.pl was an authrequired page
Now, its authnotrequired if creating or viewing an unauthenticated
request

Signed-off-by: David Nind <david@davidnind.com>
Comment 17 Pedro Amorim 2024-09-12 09:35:06 UTC
Created attachment 171368 [details] [review]
Bug 36197: Unauthenticated patron can always place ILL request if ILLOpacUnauthenticatedRequest

Signed-off-by: David Nind <david@davidnind.com>
Comment 18 Pedro Amorim 2024-09-12 09:35:09 UTC
Created attachment 171369 [details] [review]
Bug 36197: Only add cardnumber info to request is a user is logged in

Signed-off-by: David Nind <david@davidnind.com>
Comment 19 Pedro Amorim 2024-09-12 09:35:12 UTC
Created attachment 171370 [details] [review]
Bug 36197: OPAC 'Make an ILL request' link

Show the 'Make an ILL request' link for
unauthenticated users in the OPAC search results page
if ILLOpacUnauthenticatedRequest is enabled.

Signed-off-by: David Nind <david@davidnind.com>
Comment 20 Pedro Amorim 2024-09-12 09:35:15 UTC
Created attachment 171371 [details] [review]
Bug 36197: Add tests

0) If k-t-d, run updatedatabase (ignore this if testing on a sandbox)
1) Enable ILLModule syspref:
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModule
2) No need to install a backend as 35570 is in the tree
3) On a different browser session, without being lgoged in, access the create ILL request OPAC page directly:
  {opac_url}/cgi-bin/koha/opac-illrequests.pl?method=create&backend=Standard
4) Notice you're presented with the login page, as expected
5) Enable ILLOpacUnauthenticatedRequest:
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLOpacUnauthenticatedRequest
6) Repeat step 3) Notice you now get the create ILL request form, with some additional inputs at the top specific to an unauthenticated request (first name, last name, e-mail address)
6.5) (optional) Confirm the 'Make an Interlibrary loan request' link exists at the bottom of the search results page, while unauthenticated on OPAC:
  {opac_url}/cgi-bin/koha/opac-search.pl?idx=&q=music&weight_search=1
  This should only show for authenticated OPAC users if ILLOpacUnauthenticatedRequest is off.
7) Test the form, try submitting with some blank fields, change type and library after and before inputing data in the input fields, etc.
8) Submit the form successfully. Notice you're presented with the unauthenticated request submission confirmation screen with a message and request details.
9) Go back to Staff UI, logged in, access ILL requests and confirm the unauthenticated request submitted through the OPAC is there:
  {staff_url}/cgi-bin/koha/ill/ill-requests.pl
10) Test that you can add a patron afterwards, if needed, by clicking 'Edit request' on the toolbar of the manage request page, and entering a patron ID
11) Test that you're able to 'confirm' the request by clicking 'Confirm request', as if it was a regular 'NEW' request.

Additional testing:
 Make sure existing ILL functionality interacts with this new optional workflow behavior.
 For this, we're using ILLModuleDisclaimerByType. ILLCheckAvailability or AutoILLBackendPriority can also be used but require more setup (plugins, credentials, etc)
1) Configure ILLModuleDisclaimerByType, visit
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModuleDisclaimerByType
2) Click the 'edit' link at the bottom of the syspref and copy the example code from the description into the text box. Save.
3) Repeat the original test plan from above, but make sure the request type is not 'article' (as that type is bypassed). Use 'journal', for example. Submit the request making sure you fill in all mandatory fields.
4) Notice you're now presented with the ILL request disclaimer screen, hit Submit. Notice the request is created as before.
5) Return to Staff UI, logged in, confirm this 2nd unauthenticated request has been created and the type disclaimer info is stored and presented when viewing the request.

Run tests (k-t-d only):
  prove t/db_dependent/Koha/ILL/Backends.t
  prove t/db_dependent/selenium/opac_ill_requests.t

Sponsored-by: NHS England (National Health Service England)

Signed-off-by: David Nind <david@davidnind.com>
Comment 21 David Cook 2024-09-27 18:01:13 UTC
As Matthias mentioned during the Kohacon ILL workshop, there's nothing preventing bots from abusing this at the moment.

But it would be similar to anonymous/unauthenticated purchase suggestions with AnonSuggestions enabled. 

--

That said, perhaps a magic token for EDS to include in the generated URL or a referrer check could be useful to reduce robot spam (which is an existing problem with AnonSuggestions currently).
Comment 22 Pedro Amorim 2024-09-30 08:56:41 UTC
(In reply to David Cook from comment #21)
> As Matthias mentioned during the Kohacon ILL workshop, there's nothing
> preventing bots from abusing this at the moment.
> 
> But it would be similar to anonymous/unauthenticated purchase suggestions
> with AnonSuggestions enabled. 
> 
> --
> 
> That said, perhaps a magic token for EDS to include in the generated URL or
> a referrer check could be useful to reduce robot spam (which is an existing
> problem with AnonSuggestions currently).

There is already an existing captcha system present in opac-memberentry.pl (for patron self registration).
Would it make more sense to make use of this here by re utilizing it (doing any necessary refactoring), thus having a single place to extend and maintain going forward and perhaps establish a pattern for public facing forms in Koha, e.g. also apply it to unauthenticated purchase suggestions in the future?
Comment 23 David Cook 2024-09-30 23:36:08 UTC
(In reply to Pedro Amorim from comment #22)
> There is already an existing captcha system present in opac-memberentry.pl
> (for patron self registration).
> Would it make more sense to make use of this here by re utilizing it (doing
> any necessary refactoring), thus having a single place to extend and
> maintain going forward and perhaps establish a pattern for public facing
> forms in Koha, e.g. also apply it to unauthenticated purchase suggestions in
> the future?

Hmm there's a thought. That would potentially help against bots. Off the top of my head, I don't think I've heard complaints of bots doing self-registrations. 

I just remembered that somewhere had a negative captcha, and it looks like opac-suggestions.tt is the one implementing that, but I think most bots can easily bypass that one these days. 

I think I still feel a bit weird about unauthenticated ILLs, but I suppose they're not really that different to unauthenticated purchase suggestions, although I don't love those either. But then in both cases they're staff mediated anyway... so I suppose that's all right. 

But yeah... some kind of capture is needed I think.
Comment 24 Pedro Amorim 2024-11-14 11:37:12 UTC
Created attachment 174495 [details] [review]
Bug 36197: Add ILLOpacUnauthenticatedRequest sys pref

Signed-off-by: David Nind <david@davidnind.com>
Comment 25 Pedro Amorim 2024-11-14 11:37:15 UTC
Created attachment 174496 [details] [review]
Bug 36197: Add opac_unauthenticated_ill_requests backend capability to 'Standard' backend

Signed-off-by: David Nind <david@davidnind.com>
Comment 26 Pedro Amorim 2024-11-14 11:37:18 UTC
Created attachment 174497 [details] [review]
Bug 36197: Consider unauthenticated_ill in 'Standard' create form

This also makes sure an empty left side bar exists for opac unauthenticated screens

Signed-off-by: David Nind <david@davidnind.com>
Comment 27 Pedro Amorim 2024-11-14 11:37:21 UTC
Created attachment 174498 [details] [review]
Bug 36197: Refactor -> opac_available_backends method

Signed-off-by: David Nind <david@davidnind.com>
Comment 28 Pedro Amorim 2024-11-14 11:37:23 UTC
Created attachment 174499 [details] [review]
Bug 36197: Add UNAUTH Standard request status

Assign this new UNAUTH status for unauthenticated requests

Signed-off-by: David Nind <david@davidnind.com>
Comment 29 Pedro Amorim 2024-11-14 11:37:27 UTC
Created attachment 174500 [details] [review]
Bug 36197: Update how form params are validated

Validating an unauth request form requires checking for unauth info
fields.
Validating a regular authenticated request requires checking for
borrower information.

Signed-off-by: David Nind <david@davidnind.com>
Comment 30 Pedro Amorim 2024-11-14 11:37:29 UTC
Created attachment 174501 [details] [review]
Bug 36197: Update how the request is added:

- Do not validate borrower if its an unauthenticated request
- Set borrowernumber to null if its an unauthenticated request
- Add staff and OPAC notes with unauthenticated request info

Signed-off-by: David Nind <david@davidnind.com>
Comment 31 Pedro Amorim 2024-11-14 11:37:32 UTC
Created attachment 174502 [details] [review]
Bug 36197: Only check limits for regular requests

Skip for unauthenticated requests

Signed-off-by: David Nind <david@davidnind.com>
Comment 32 Pedro Amorim 2024-11-14 11:37:35 UTC
Created attachment 174503 [details] [review]
Bug 36197: OPAC unauthenticated screen

unauth_view to show request details after its been submitted

Signed-off-by: David Nind <david@davidnind.com>
Comment 33 Pedro Amorim 2024-11-14 11:37:38 UTC
Created attachment 174504 [details] [review]
Bug 36197: Make authentication not required if conditions are met

/cgi-bin/koha/opac-illrequests.pl was an authrequired page
Now, its authnotrequired if creating or viewing an unauthenticated
request

Signed-off-by: David Nind <david@davidnind.com>
Comment 34 Pedro Amorim 2024-11-14 11:37:41 UTC
Created attachment 174505 [details] [review]
Bug 36197: Unauthenticated patron can always place ILL request if ILLOpacUnauthenticatedRequest

Signed-off-by: David Nind <david@davidnind.com>
Comment 35 Pedro Amorim 2024-11-14 11:37:44 UTC
Created attachment 174506 [details] [review]
Bug 36197: Only add cardnumber info to request is a user is logged in

Signed-off-by: David Nind <david@davidnind.com>
Comment 36 Pedro Amorim 2024-11-14 11:37:47 UTC
Created attachment 174507 [details] [review]
Bug 36197: OPAC 'Make an ILL request' link

Show the 'Make an ILL request' link for
unauthenticated users in the OPAC search results page
if ILLOpacUnauthenticatedRequest is enabled.

Signed-off-by: David Nind <david@davidnind.com>
Comment 37 Pedro Amorim 2024-11-14 11:37:51 UTC
Created attachment 174508 [details] [review]
Bug 36197: Add tests

0) If k-t-d, run updatedatabase (ignore this if testing on a sandbox)
1) Enable ILLModule syspref:
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModule
2) No need to install a backend as 35570 is in the tree
3) On a different browser session, without being lgoged in, access the create ILL request OPAC page directly:
  {opac_url}/cgi-bin/koha/opac-illrequests.pl?method=create&backend=Standard
4) Notice you're presented with the login page, as expected
5) Enable ILLOpacUnauthenticatedRequest:
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLOpacUnauthenticatedRequest
6) Repeat step 3) Notice you now get the create ILL request form, with some additional inputs at the top specific to an unauthenticated request (first name, last name, e-mail address)
6.5) (optional) Confirm the 'Make an Interlibrary loan request' link exists at the bottom of the search results page, while unauthenticated on OPAC:
  {opac_url}/cgi-bin/koha/opac-search.pl?idx=&q=music&weight_search=1
  This should only show for authenticated OPAC users if ILLOpacUnauthenticatedRequest is off.
7) Test the form, try submitting with some blank fields, change type and library after and before inputing data in the input fields, etc.
8) Submit the form successfully. Notice you're presented with the unauthenticated request submission confirmation screen with a message and request details.
9) Go back to Staff UI, logged in, access ILL requests and confirm the unauthenticated request submitted through the OPAC is there:
  {staff_url}/cgi-bin/koha/ill/ill-requests.pl
10) Test that you can add a patron afterwards, if needed, by clicking 'Edit request' on the toolbar of the manage request page, and entering a patron ID
11) Test that you're able to 'confirm' the request by clicking 'Confirm request', as if it was a regular 'NEW' request.

Additional testing:
 Make sure existing ILL functionality interacts with this new optional workflow behavior.
 For this, we're using ILLModuleDisclaimerByType. ILLCheckAvailability or AutoILLBackendPriority can also be used but require more setup (plugins, credentials, etc)
1) Configure ILLModuleDisclaimerByType, visit
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModuleDisclaimerByType
2) Click the 'edit' link at the bottom of the syspref and copy the example code from the description into the text box. Save.
3) Repeat the original test plan from above, but make sure the request type is not 'article' (as that type is bypassed). Use 'journal', for example. Submit the request making sure you fill in all mandatory fields.
4) Notice you're now presented with the ILL request disclaimer screen, hit Submit. Notice the request is created as before.
5) Return to Staff UI, logged in, confirm this 2nd unauthenticated request has been created and the type disclaimer info is stored and presented when viewing the request.

Run tests (k-t-d only):
  prove t/db_dependent/Koha/ILL/Backends.t
  prove t/db_dependent/selenium/opac_ill_requests.t

Sponsored-by: NHS England (National Health Service England)

Signed-off-by: David Nind <david@davidnind.com>
Comment 38 Pedro Amorim 2025-01-15 12:39:15 UTC
Created attachment 176564 [details] [review]
Bug 36197: (QA follow-up): Fix testcritic.t

prove t/00-testcritic.t
Comment 39 Pedro Amorim 2025-01-15 13:11:27 UTC
Created attachment 176565 [details] [review]
Bug 36197: (QA follow-up): Fix PluginRoutes.t

prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t
Comment 40 Pedro Amorim 2025-01-16 15:52:11 UTC
Created attachment 176680 [details] [review]
Bug 36197: (QA follow-up): Make ConfirmAuto::get_priority_backends respect opac_available_backends if OPAC

This makes it so that the Auto ILL stage on OPAC only queries opac_available_backends.
Fix is submitted here and not in bug 35604 because it's here that opac_available_backends is implemented.
Comment 41 Pedro Amorim 2025-01-17 12:04:11 UTC
Created attachment 176723 [details] [review]
Bug 36197: (QA follow-up): Fix backends filtering in opac_available_backends

This was incorrectly keeping backends that don't support unauthenticated ILL requests if more than one existed.
Comment 42 Pedro Amorim 2025-01-17 12:04:14 UTC
Created attachment 176724 [details] [review]
Bug 36197: (QA follow-up): Pass the filtered OPAC backends to OPAC template

The list of backends in the dropdown in this page:
http://localhost:8080/cgi-bin/koha/opac-illrequests.pl?op=create

If unauthenticated is enabled, this is listing all backends, instead of
making use of opac_available_backends.
Comment 43 Pedro Amorim 2025-01-17 13:03:23 UTC
Created attachment 176726 [details] [review]
Bug 36197: (QA follow-up): Move unauthenticated_notes to core

Move this out of Standard specific logic.
Other backends that support unauthenticated requests may want to make use of this and not duplicate code.
Also make these notes translatable.
Comment 44 Pedro Amorim 2025-01-17 13:12:08 UTC
Created attachment 176727 [details] [review]
Bug 36197: (QA follow-up): Move unauth_request_data_check to core

Move this out of Standard specific logic.
    Other backends that support unauthenticated requests may want to make use of this and not duplicate code.
Comment 45 Pedro Amorim 2025-03-27 12:17:03 UTC
Created attachment 179764 [details] [review]
Bug 36197: Add ILLOpacUnauthenticatedRequest sys pref

Signed-off-by: David Nind <david@davidnind.com>
Comment 46 Pedro Amorim 2025-03-27 12:17:07 UTC
Created attachment 179765 [details] [review]
Bug 36197: Add opac_unauthenticated_ill_requests backend capability to 'Standard' backend

Signed-off-by: David Nind <david@davidnind.com>
Comment 47 Pedro Amorim 2025-03-27 12:17:10 UTC
Created attachment 179766 [details] [review]
Bug 36197: Consider unauthenticated_ill in 'Standard' create form

This also makes sure an empty left side bar exists for opac unauthenticated screens

Signed-off-by: David Nind <david@davidnind.com>
Comment 48 Pedro Amorim 2025-03-27 12:17:14 UTC
Created attachment 179767 [details] [review]
Bug 36197: Refactor -> opac_available_backends method

Signed-off-by: David Nind <david@davidnind.com>
Comment 49 Pedro Amorim 2025-03-27 12:17:18 UTC
Created attachment 179769 [details] [review]
Bug 36197: Add UNAUTH Standard request status

Assign this new UNAUTH status for unauthenticated requests

Signed-off-by: David Nind <david@davidnind.com>
Comment 50 Pedro Amorim 2025-03-27 12:17:22 UTC
Created attachment 179770 [details] [review]
Bug 36197: Update how form params are validated

Validating an unauth request form requires checking for unauth info
fields.
Validating a regular authenticated request requires checking for
borrower information.

Signed-off-by: David Nind <david@davidnind.com>
Comment 51 Pedro Amorim 2025-03-27 12:17:26 UTC
Created attachment 179771 [details] [review]
Bug 36197: Update how the request is added:

- Do not validate borrower if its an unauthenticated request
- Set borrowernumber to null if its an unauthenticated request
- Add staff and OPAC notes with unauthenticated request info

Signed-off-by: David Nind <david@davidnind.com>
Comment 52 Pedro Amorim 2025-03-27 12:17:31 UTC
Created attachment 179772 [details] [review]
Bug 36197: Only check limits for regular requests

Skip for unauthenticated requests

Signed-off-by: David Nind <david@davidnind.com>
Comment 53 Pedro Amorim 2025-03-27 12:17:35 UTC
Created attachment 179773 [details] [review]
Bug 36197: OPAC unauthenticated screen

unauth_view to show request details after its been submitted

Signed-off-by: David Nind <david@davidnind.com>
Comment 54 Pedro Amorim 2025-03-27 12:17:38 UTC
Created attachment 179774 [details] [review]
Bug 36197: Make authentication not required if conditions are met

/cgi-bin/koha/opac-illrequests.pl was an authrequired page
Now, its authnotrequired if creating or viewing an unauthenticated
request

Signed-off-by: David Nind <david@davidnind.com>
Comment 55 Pedro Amorim 2025-03-27 12:17:42 UTC
Created attachment 179775 [details] [review]
Bug 36197: Unauthenticated patron can always place ILL request if ILLOpacUnauthenticatedRequest

Signed-off-by: David Nind <david@davidnind.com>
Comment 56 Pedro Amorim 2025-03-27 12:17:45 UTC
Created attachment 179776 [details] [review]
Bug 36197: Only add cardnumber info to request is a user is logged in

Signed-off-by: David Nind <david@davidnind.com>
Comment 57 Pedro Amorim 2025-03-27 12:17:49 UTC
Created attachment 179777 [details] [review]
Bug 36197: OPAC 'Make an ILL request' link

Show the 'Make an ILL request' link for
unauthenticated users in the OPAC search results page
if ILLOpacUnauthenticatedRequest is enabled.

Signed-off-by: David Nind <david@davidnind.com>
Comment 58 Pedro Amorim 2025-03-27 12:17:52 UTC
Created attachment 179778 [details] [review]
Bug 36197: Add tests

0) If k-t-d, run updatedatabase (ignore this if testing on a sandbox)
1) Enable ILLModule syspref:
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModule
2) No need to install a backend as 35570 is in the tree
3) On a different browser session, without being lgoged in, access the create ILL request OPAC page directly:
  {opac_url}/cgi-bin/koha/opac-illrequests.pl?method=create&backend=Standard
4) Notice you're presented with the login page, as expected
5) Enable ILLOpacUnauthenticatedRequest:
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLOpacUnauthenticatedRequest
6) Repeat step 3) Notice you now get the create ILL request form, with some additional inputs at the top specific to an unauthenticated request (first name, last name, e-mail address)
6.5) (optional) Confirm the 'Make an Interlibrary loan request' link exists at the bottom of the search results page, while unauthenticated on OPAC:
  {opac_url}/cgi-bin/koha/opac-search.pl?idx=&q=music&weight_search=1
  This should only show for authenticated OPAC users if ILLOpacUnauthenticatedRequest is off.
7) Test the form, try submitting with some blank fields, change type and library after and before inputing data in the input fields, etc.
8) Submit the form successfully. Notice you're presented with the unauthenticated request submission confirmation screen with a message and request details.
9) Go back to Staff UI, logged in, access ILL requests and confirm the unauthenticated request submitted through the OPAC is there:
  {staff_url}/cgi-bin/koha/ill/ill-requests.pl
10) Test that you can add a patron afterwards, if needed, by clicking 'Edit request' on the toolbar of the manage request page, and entering a patron ID
11) Test that you're able to 'confirm' the request by clicking 'Confirm request', as if it was a regular 'NEW' request.

Additional testing:
 Make sure existing ILL functionality interacts with this new optional workflow behavior.
 For this, we're using ILLModuleDisclaimerByType. ILLCheckAvailability or AutoILLBackendPriority can also be used but require more setup (plugins, credentials, etc)
1) Configure ILLModuleDisclaimerByType, visit
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModuleDisclaimerByType
2) Click the 'edit' link at the bottom of the syspref and copy the example code from the description into the text box. Save.
3) Repeat the original test plan from above, but make sure the request type is not 'article' (as that type is bypassed). Use 'journal', for example. Submit the request making sure you fill in all mandatory fields.
4) Notice you're now presented with the ILL request disclaimer screen, hit Submit. Notice the request is created as before.
5) Return to Staff UI, logged in, confirm this 2nd unauthenticated request has been created and the type disclaimer info is stored and presented when viewing the request.

Run tests (k-t-d only):
  prove t/db_dependent/Koha/ILL/Backends.t
  prove t/db_dependent/selenium/opac_ill_requests.t

Sponsored-by: NHS England (National Health Service England)

Signed-off-by: David Nind <david@davidnind.com>
Comment 59 Pedro Amorim 2025-03-27 12:17:56 UTC
Created attachment 179779 [details] [review]
Bug 36197: (QA follow-up): Fix testcritic.t

prove t/00-testcritic.t
Comment 60 Pedro Amorim 2025-03-27 12:18:00 UTC
Created attachment 179780 [details] [review]
Bug 36197: (QA follow-up): Fix PluginRoutes.t

prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t
Comment 61 Pedro Amorim 2025-03-27 12:18:03 UTC
Created attachment 179781 [details] [review]
Bug 36197: (QA follow-up): Make ConfirmAuto::get_priority_backends respect opac_available_backends if OPAC

This makes it so that the Auto ILL stage on OPAC only queries opac_available_backends.
Fix is submitted here and not in bug 35604 because it's here that opac_available_backends is implemented.
Comment 62 Pedro Amorim 2025-03-27 12:18:07 UTC
Created attachment 179782 [details] [review]
Bug 36197: (QA follow-up): Fix backends filtering in opac_available_backends

This was incorrectly keeping backends that don't support unauthenticated ILL requests if more than one existed.
Comment 63 Pedro Amorim 2025-03-27 12:18:11 UTC
Created attachment 179783 [details] [review]
Bug 36197: (QA follow-up): Pass the filtered OPAC backends to OPAC template

The list of backends in the dropdown in this page:
http://localhost:8080/cgi-bin/koha/opac-illrequests.pl?op=create

If unauthenticated is enabled, this is listing all backends, instead of
making use of opac_available_backends.
Comment 64 Pedro Amorim 2025-03-27 12:18:15 UTC
Created attachment 179784 [details] [review]
Bug 36197: (QA follow-up): Move unauthenticated_notes to core

Move this out of Standard specific logic.
Other backends that support unauthenticated requests may want to make use of this and not duplicate code.
Also make these notes translatable.
Comment 65 Pedro Amorim 2025-03-27 12:18:19 UTC
Created attachment 179785 [details] [review]
Bug 36197: (QA follow-up): Move unauth_request_data_check to core

Move this out of Standard specific logic.
    Other backends that support unauthenticated requests may want to make use of this and not duplicate code.
Comment 66 Pedro Amorim 2025-03-27 12:18:46 UTC
Rebased and tidied on top of tidied bug 35604
Comment 67 Pedro Amorim 2025-04-02 13:47:42 UTC Comment hidden (obsolete)
Comment 68 Pedro Amorim 2025-04-02 13:49:21 UTC Comment hidden (obsolete)
Comment 69 Pedro Amorim 2025-04-02 13:50:13 UTC
TODO's from Hackfest's QA session:
1) Use "We'll contact you shortly" instead of "Check your email" after an unauthenticated request has been placed
2) unauthenticated fields should use their own respective illrequestattributes, removed from notes and staffnotes
3) update request page template to list all 3 unauthenticated fields
Comment 70 Pedro Amorim 2025-04-11 14:22:46 UTC
Created attachment 180850 [details] [review]
Bug 36197: Add ILLOpacUnauthenticatedRequest sys pref

Signed-off-by: David Nind <david@davidnind.com>
Comment 71 Pedro Amorim 2025-04-11 14:22:49 UTC
Created attachment 180851 [details] [review]
Bug 36197: Add opac_unauthenticated_ill_requests backend capability to 'Standard' backend

Signed-off-by: David Nind <david@davidnind.com>
Comment 72 Pedro Amorim 2025-04-11 14:22:53 UTC
Created attachment 180852 [details] [review]
Bug 36197: Consider unauthenticated_ill in 'Standard' create form

This also makes sure an empty left side bar exists for opac unauthenticated screens

Signed-off-by: David Nind <david@davidnind.com>
Comment 73 Pedro Amorim 2025-04-11 14:22:56 UTC
Created attachment 180853 [details] [review]
Bug 36197: Refactor -> opac_available_backends method

Signed-off-by: David Nind <david@davidnind.com>
Comment 74 Pedro Amorim 2025-04-11 14:23:00 UTC
Created attachment 180854 [details] [review]
Bug 36197: Add UNAUTH Standard request status

Assign this new UNAUTH status for unauthenticated requests

Signed-off-by: David Nind <david@davidnind.com>
Comment 75 Pedro Amorim 2025-04-11 14:23:03 UTC
Created attachment 180855 [details] [review]
Bug 36197: Update how form params are validated

Validating an unauth request form requires checking for unauth info
fields.
Validating a regular authenticated request requires checking for
borrower information.

Signed-off-by: David Nind <david@davidnind.com>
Comment 76 Pedro Amorim 2025-04-11 14:23:07 UTC
Created attachment 180856 [details] [review]
Bug 36197: Update how the request is added:

- Do not validate borrower if its an unauthenticated request
- Set borrowernumber to null if its an unauthenticated request
- Add staff and OPAC notes with unauthenticated request info

Signed-off-by: David Nind <david@davidnind.com>
Comment 77 Pedro Amorim 2025-04-11 14:23:10 UTC
Created attachment 180857 [details] [review]
Bug 36197: Only check limits for regular requests

Skip for unauthenticated requests

Signed-off-by: David Nind <david@davidnind.com>
Comment 78 Pedro Amorim 2025-04-11 14:23:14 UTC
Created attachment 180858 [details] [review]
Bug 36197: OPAC unauthenticated screen

unauth_view to show request details after its been submitted

Signed-off-by: David Nind <david@davidnind.com>
Comment 79 Pedro Amorim 2025-04-11 14:23:18 UTC
Created attachment 180859 [details] [review]
Bug 36197: Make authentication not required if conditions are met

/cgi-bin/koha/opac-illrequests.pl was an authrequired page
Now, its authnotrequired if creating or viewing an unauthenticated
request

Signed-off-by: David Nind <david@davidnind.com>
Comment 80 Pedro Amorim 2025-04-11 14:23:21 UTC
Created attachment 180860 [details] [review]
Bug 36197: Unauthenticated patron can always place ILL request if ILLOpacUnauthenticatedRequest

Signed-off-by: David Nind <david@davidnind.com>
Comment 81 Pedro Amorim 2025-04-11 14:23:25 UTC
Created attachment 180861 [details] [review]
Bug 36197: Only add cardnumber info to request is a user is logged in

Signed-off-by: David Nind <david@davidnind.com>
Comment 82 Pedro Amorim 2025-04-11 14:23:29 UTC
Created attachment 180862 [details] [review]
Bug 36197: OPAC 'Make an ILL request' link

Show the 'Make an ILL request' link for
unauthenticated users in the OPAC search results page
if ILLOpacUnauthenticatedRequest is enabled.

Signed-off-by: David Nind <david@davidnind.com>
Comment 83 Pedro Amorim 2025-04-11 14:23:33 UTC
Created attachment 180863 [details] [review]
Bug 36197: Add tests

0) If k-t-d, run updatedatabase (ignore this if testing on a sandbox)
1) Enable ILLModule syspref:
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModule
2) No need to install a backend as 35570 is in the tree
3) On a different browser session, without being lgoged in, access the create ILL request OPAC page directly:
  {opac_url}/cgi-bin/koha/opac-illrequests.pl?method=create&backend=Standard
4) Notice you're presented with the login page, as expected
5) Enable ILLOpacUnauthenticatedRequest:
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLOpacUnauthenticatedRequest
6) Repeat step 3) Notice you now get the create ILL request form, with some additional inputs at the top specific to an unauthenticated request (first name, last name, e-mail address)
6.5) (optional) Confirm the 'Make an Interlibrary loan request' link exists at the bottom of the search results page, while unauthenticated on OPAC:
  {opac_url}/cgi-bin/koha/opac-search.pl?idx=&q=music&weight_search=1
  This should only show for authenticated OPAC users if ILLOpacUnauthenticatedRequest is off.
7) Test the form, try submitting with some blank fields, change type and library after and before inputing data in the input fields, etc.
8) Submit the form successfully. Notice you're presented with the unauthenticated request submission confirmation screen with a message and request details.
9) Go back to Staff UI, logged in, access ILL requests and confirm the unauthenticated request submitted through the OPAC is there:
  {staff_url}/cgi-bin/koha/ill/ill-requests.pl
10) Test that you can add a patron afterwards, if needed, by clicking 'Edit request' on the toolbar of the manage request page, and entering a patron ID
11) Test that you're able to 'confirm' the request by clicking 'Confirm request', as if it was a regular 'NEW' request.

Additional testing:
 Make sure existing ILL functionality interacts with this new optional workflow behavior.
 For this, we're using ILLModuleDisclaimerByType. ILLCheckAvailability or AutoILLBackendPriority can also be used but require more setup (plugins, credentials, etc)
1) Configure ILLModuleDisclaimerByType, visit
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModuleDisclaimerByType
2) Click the 'edit' link at the bottom of the syspref and copy the example code from the description into the text box. Save.
3) Repeat the original test plan from above, but make sure the request type is not 'article' (as that type is bypassed). Use 'journal', for example. Submit the request making sure you fill in all mandatory fields.
4) Notice you're now presented with the ILL request disclaimer screen, hit Submit. Notice the request is created as before.
5) Return to Staff UI, logged in, confirm this 2nd unauthenticated request has been created and the type disclaimer info is stored and presented when viewing the request.

Run tests (k-t-d only):
  prove t/db_dependent/Koha/ILL/Request/Config.t
  prove t/db_dependent/selenium/opac_ill_requests.t

Sponsored-by: NHS England (National Health Service England)

Signed-off-by: David Nind <david@davidnind.com>
Comment 84 Pedro Amorim 2025-04-11 14:23:36 UTC
Created attachment 180864 [details] [review]
Bug 36197: (QA follow-up): Fix testcritic.t

prove t/00-testcritic.t
Comment 85 Pedro Amorim 2025-04-11 14:23:40 UTC
Created attachment 180865 [details] [review]
Bug 36197: (QA follow-up): Fix PluginRoutes.t

prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t
Comment 86 Pedro Amorim 2025-04-11 14:23:44 UTC
Created attachment 180866 [details] [review]
Bug 36197: (QA follow-up): Make ConfirmAuto::get_priority_backends respect opac_available_backends if OPAC

This makes it so that the Auto ILL stage on OPAC only queries opac_available_backends.
Fix is submitted here and not in bug 35604 because it's here that opac_available_backends is implemented.
Comment 87 Pedro Amorim 2025-04-11 14:23:47 UTC
Created attachment 180867 [details] [review]
Bug 36197: (QA follow-up): Fix backends filtering in opac_available_backends

This was incorrectly keeping backends that don't support unauthenticated ILL requests if more than one existed.
Comment 88 Pedro Amorim 2025-04-11 14:23:51 UTC
Created attachment 180868 [details] [review]
Bug 36197: (QA follow-up): Pass the filtered OPAC backends to OPAC template

The list of backends in the dropdown in this page:
http://localhost:8080/cgi-bin/koha/opac-illrequests.pl?op=create

If unauthenticated is enabled, this is listing all backends, instead of
making use of opac_available_backends.
Comment 89 Pedro Amorim 2025-04-11 14:23:54 UTC
Created attachment 180869 [details] [review]
Bug 36197: (QA follow-up): Move unauthenticated_notes to core

Move this out of Standard specific logic.
Other backends that support unauthenticated requests may want to make use of this and not duplicate code.
Also make these notes translatable.
Comment 90 Pedro Amorim 2025-04-11 14:23:58 UTC
Created attachment 180870 [details] [review]
Bug 36197: (QA follow-up): Move unauth_request_data_check to core

Move this out of Standard specific logic.
    Other backends that support unauthenticated requests may want to make use of this and not duplicate code.
Comment 91 Pedro Amorim 2025-04-11 14:24:02 UTC
Created attachment 180871 [details] [review]
Bug 36197: (QA follow-up): Hackfest followup WIP

Moved unauth data to their respective illrequestattributes entries
instead of staffnotes + opacnotes.
Update confirmation message
Comment 92 Pedro Amorim 2025-04-11 14:24:05 UTC
Created attachment 180872 [details] [review]
Bug 36197: (QA follow-up): Add public form captcha

Feedback provided by David Cook + Matthias Meusburger at KohaCon24
Comment 93 Pedro Amorim 2025-04-11 14:24:09 UTC
Created attachment 180873 [details] [review]
Bug 36197: (QA follow-up): Adopt POST REDIRECT GET pattern

Upon submitting the unauthenticated request, the user is now redirected to a different page and the request details are passed through a session variable. This is to prevent the user from being able to resubmit the same unauthenticated request multiple times (see security bug 39611)
Comment 94 Pedro Amorim 2025-04-11 14:25:47 UTC
Hi guys, this last submission adds the following changes:
1) Rebase on top of QA changes made by Tomas to bug 35604, including moving the opac_available_backends method from the no longer existent Backends.pm file into ILL::Request::Config instead
2) Hackfest QA feedback addressed
3) Added a new captcha to the public facing form
4) Upon revisiting and testing further, I discovered the user was able to resubmit the same form multiple times, so I've addressed that in the last patch. I've also found this behavior somewhere else in Koha and have filed a security bug for that.
Comment 95 Tomás Cohen Arazi (tcohen) 2025-04-17 13:39:40 UTC
Created attachment 181073 [details] [review]
Bug 36197: Add ILLOpacUnauthenticatedRequest sys pref

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 96 Tomás Cohen Arazi (tcohen) 2025-04-17 13:39:44 UTC
Created attachment 181074 [details] [review]
Bug 36197: Add opac_unauthenticated_ill_requests backend capability to 'Standard' backend

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 97 Tomás Cohen Arazi (tcohen) 2025-04-17 13:39:47 UTC
Created attachment 181075 [details] [review]
Bug 36197: Consider unauthenticated_ill in 'Standard' create form

This also makes sure an empty left side bar exists for opac unauthenticated screens

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 98 Tomás Cohen Arazi (tcohen) 2025-04-17 13:39:50 UTC
Created attachment 181076 [details] [review]
Bug 36197: Refactor -> opac_available_backends method

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 99 Tomás Cohen Arazi (tcohen) 2025-04-17 13:39:53 UTC
Created attachment 181077 [details] [review]
Bug 36197: Add UNAUTH Standard request status

Assign this new UNAUTH status for unauthenticated requests

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 100 Tomás Cohen Arazi (tcohen) 2025-04-17 13:39:56 UTC
Created attachment 181078 [details] [review]
Bug 36197: Update how form params are validated

Validating an unauth request form requires checking for unauth info
fields.
Validating a regular authenticated request requires checking for
borrower information.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 101 Tomás Cohen Arazi (tcohen) 2025-04-17 13:39:59 UTC
Created attachment 181079 [details] [review]
Bug 36197: Update how the request is added:

- Do not validate borrower if its an unauthenticated request
- Set borrowernumber to null if its an unauthenticated request
- Add staff and OPAC notes with unauthenticated request info

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 102 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:02 UTC
Created attachment 181080 [details] [review]
Bug 36197: Only check limits for regular requests

Skip for unauthenticated requests

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 103 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:06 UTC
Created attachment 181081 [details] [review]
Bug 36197: OPAC unauthenticated screen

unauth_view to show request details after its been submitted

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 104 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:10 UTC
Created attachment 181082 [details] [review]
Bug 36197: Make authentication not required if conditions are met

/cgi-bin/koha/opac-illrequests.pl was an authrequired page
Now, its authnotrequired if creating or viewing an unauthenticated
request

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 105 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:13 UTC
Created attachment 181083 [details] [review]
Bug 36197: Unauthenticated patron can always place ILL request if ILLOpacUnauthenticatedRequest

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 106 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:16 UTC
Created attachment 181084 [details] [review]
Bug 36197: Only add cardnumber info to request is a user is logged in

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 107 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:19 UTC
Created attachment 181085 [details] [review]
Bug 36197: OPAC 'Make an ILL request' link

Show the 'Make an ILL request' link for
unauthenticated users in the OPAC search results page
if ILLOpacUnauthenticatedRequest is enabled.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 108 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:22 UTC
Created attachment 181086 [details] [review]
Bug 36197: Add tests

0) If k-t-d, run updatedatabase (ignore this if testing on a sandbox)
1) Enable ILLModule syspref:
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModule
2) No need to install a backend as 35570 is in the tree
3) On a different browser session, without being lgoged in, access the create ILL request OPAC page directly:
  {opac_url}/cgi-bin/koha/opac-illrequests.pl?method=create&backend=Standard
4) Notice you're presented with the login page, as expected
5) Enable ILLOpacUnauthenticatedRequest:
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLOpacUnauthenticatedRequest
6) Repeat step 3) Notice you now get the create ILL request form, with some additional inputs at the top specific to an unauthenticated request (first name, last name, e-mail address)
6.5) (optional) Confirm the 'Make an Interlibrary loan request' link exists at the bottom of the search results page, while unauthenticated on OPAC:
  {opac_url}/cgi-bin/koha/opac-search.pl?idx=&q=music&weight_search=1
  This should only show for authenticated OPAC users if ILLOpacUnauthenticatedRequest is off.
7) Test the form, try submitting with some blank fields, change type and library after and before inputing data in the input fields, etc.
8) Submit the form successfully. Notice you're presented with the unauthenticated request submission confirmation screen with a message and request details.
9) Go back to Staff UI, logged in, access ILL requests and confirm the unauthenticated request submitted through the OPAC is there:
  {staff_url}/cgi-bin/koha/ill/ill-requests.pl
10) Test that you can add a patron afterwards, if needed, by clicking 'Edit request' on the toolbar of the manage request page, and entering a patron ID
11) Test that you're able to 'confirm' the request by clicking 'Confirm request', as if it was a regular 'NEW' request.

Additional testing:
 Make sure existing ILL functionality interacts with this new optional workflow behavior.
 For this, we're using ILLModuleDisclaimerByType. ILLCheckAvailability or AutoILLBackendPriority can also be used but require more setup (plugins, credentials, etc)
1) Configure ILLModuleDisclaimerByType, visit
  {staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModuleDisclaimerByType
2) Click the 'edit' link at the bottom of the syspref and copy the example code from the description into the text box. Save.
3) Repeat the original test plan from above, but make sure the request type is not 'article' (as that type is bypassed). Use 'journal', for example. Submit the request making sure you fill in all mandatory fields.
4) Notice you're now presented with the ILL request disclaimer screen, hit Submit. Notice the request is created as before.
5) Return to Staff UI, logged in, confirm this 2nd unauthenticated request has been created and the type disclaimer info is stored and presented when viewing the request.

Run tests (k-t-d only):
  prove t/db_dependent/Koha/ILL/Request/Config.t
  prove t/db_dependent/selenium/opac_ill_requests.t

Sponsored-by: NHS England (National Health Service England)

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 109 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:25 UTC
Created attachment 181087 [details] [review]
Bug 36197: (QA follow-up): Fix testcritic.t

prove t/00-testcritic.t

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 110 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:28 UTC
Created attachment 181088 [details] [review]
Bug 36197: (QA follow-up): Fix PluginRoutes.t

prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 111 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:31 UTC
Created attachment 181089 [details] [review]
Bug 36197: (QA follow-up): Make ConfirmAuto::get_priority_backends respect opac_available_backends if OPAC

This makes it so that the Auto ILL stage on OPAC only queries opac_available_backends.
Fix is submitted here and not in bug 35604 because it's here that opac_available_backends is implemented.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 112 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:35 UTC
Created attachment 181090 [details] [review]
Bug 36197: (QA follow-up): Fix backends filtering in opac_available_backends

This was incorrectly keeping backends that don't support unauthenticated ILL requests if more than one existed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 113 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:38 UTC
Created attachment 181091 [details] [review]
Bug 36197: (QA follow-up): Pass the filtered OPAC backends to OPAC template

The list of backends in the dropdown in this page:
http://localhost:8080/cgi-bin/koha/opac-illrequests.pl?op=create

If unauthenticated is enabled, this is listing all backends, instead of
making use of opac_available_backends.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 114 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:41 UTC
Created attachment 181092 [details] [review]
Bug 36197: (QA follow-up): Move unauthenticated_notes to core

Move this out of Standard specific logic.
Other backends that support unauthenticated requests may want to make use of this and not duplicate code.
Also make these notes translatable.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 115 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:44 UTC
Created attachment 181093 [details] [review]
Bug 36197: (QA follow-up): Move unauth_request_data_check to core

Move this out of Standard specific logic.
    Other backends that support unauthenticated requests may want to make use of this and not duplicate code.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 116 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:47 UTC
Created attachment 181094 [details] [review]
Bug 36197: (QA follow-up): Hackfest followup WIP

Moved unauth data to their respective illrequestattributes entries
instead of staffnotes + opacnotes.
Update confirmation message

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 117 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:50 UTC
Created attachment 181095 [details] [review]
Bug 36197: (QA follow-up): Add public form captcha

Feedback provided by David Cook + Matthias Meusburger at KohaCon24

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 118 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:53 UTC
Created attachment 181096 [details] [review]
Bug 36197: (QA follow-up): Adopt POST REDIRECT GET pattern

Upon submitting the unauthenticated request, the user is now redirected to a different page and the request details are passed through a session variable. This is to prevent the user from being able to resubmit the same unauthenticated request multiple times (see security bug 39611)

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 119 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:56 UTC
Created attachment 181097 [details] [review]
Bug 36197: Atomic update style update

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 120 Tomás Cohen Arazi (tcohen) 2025-04-17 13:40:59 UTC
Created attachment 181098 [details] [review]
Bug 36197: Remove incorrect import

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 121 Tomás Cohen Arazi (tcohen) 2025-04-17 13:50:09 UTC
Pedro, thanks for taking care of the feedback we provided during the hackfest.

This looks great now. There's only two false negative errors.
Comment 122 Pedro Amorim 2025-04-17 14:26:10 UTC
That's awesome, thank you Tomas.
Comment 123 David Nind 2025-04-24 01:17:45 UTC
Thanks for the release note!
Comment 124 Katrin Fischer 2025-04-25 06:41:58 UTC
(In reply to Tomás Cohen Arazi (tcohen) from comment #121)
> Pedro, thanks for taking care of the feedback we provided during the
> hackfest.
> 
> This looks great now. There's only two false negative errors.

Thanks for the warning about the false positive(?) errors :)

Some tiny tiny stuff:

1) Spelling: E-mail vs. email

It looks like the patron form and other places in Koha prefer email over e-mail, so it would be nice to standardize. There is also a mix here between some validation messages and the form for unauthenticated ILL requests.

2) Terminology: Collection library

<label for="branchcode">Collection library:</label>

Wondering if this should be "Pickup library" instead.
Comment 125 Katrin Fischer 2025-04-25 06:48:30 UTC
Pushed for 25.05!

Well done everyone, thank you!
Comment 126 Pedro Amorim 2025-04-28 12:10:53 UTC
Created attachment 181592 [details] [review]
Bug 36197: (QA follow-up): Update terminology:

- Library input: Change 'Collection library' to 'Pickup library'.
- Update 'e-mail' to 'email'
Comment 127 Katrin Fischer 2025-05-16 15:18:03 UTC
Sorry for missing this earlier, picked up the follow-up now.