Bug 36561 - Inappropriate permission for "/api/v1/auth/password/validation"
Summary: Inappropriate permission for "/api/v1/auth/password/validation"
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Web services (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor (vote)
Assignee: David Cook
QA Contact: Testopia
URL:
Keywords:
Depends on: 30962
Blocks:
  Show dependency treegraph
 
Reported: 2024-04-10 04:37 UTC by David Cook
Modified: 2024-04-29 04:22 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 36561: Add "validate_borrowers" permission for /api/v1/auth/password/validation (4.27 KB, patch)
2024-04-24 06:16 UTC, David Cook
Details | Diff | Splinter Review
Bug 36561: Add "validate_borrowers" permission for /api/v1/auth/password/validation (5.27 KB, patch)
2024-04-29 00:38 UTC, David Cook
Details | Diff | Splinter Review
Bug 36561: Add "validate_borrowers" permission for /api/v1/auth/password/validation (5.31 KB, patch)
2024-04-29 04:22 UTC, David Nind
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2024-04-10 04:37:09 UTC
Today I was looking to replace a third-party's usage of ILS-DI AuthenticatePatron with the REST API's "/api/v1/auth/password/validation", when I realized that it would mean giving the third-party much greater Koha permission than they currently have.

"/api/v1/auth/password/validation" requires the "borrowers" permission, which gives you full access to all borrower data. 

I don't think that's what we want to give a third-party that really just needs to validate that a patron is an authentic member of Koha. 

I think that we might need a new permission class. I don't have a perfect name for it yet, but I'm thinking about it. Here's some ideas:

- Discovery
- External
- API
- Web services
- Third-party

--

That way, we can have third-party API users that are narrowly scoped to just what they need to do.
Comment 1 David Cook 2024-04-10 04:40:25 UTC
Then again... maybe I'm wrong.

Maybe this endpoint just needs a subpermission of "validate_borrowers". 

That would be a very easy change to make, and it would be backwards compatible, since "borrowers: 1" would already include "validate_borrowers". 

--

Of course, at some point, we'd need an ILS-DI GetPatronInfo replacement which doesn't reveal everything about the patron, but gives a third-party system enough to work with.

Martin has been interested in this topic in terms of scopes that users consent to.
Comment 2 David Cook 2024-04-10 04:44:54 UTC
Of course, part of the issue for these third-party systems is that their API user does things "outside of the context of a user". 

It would be great to have integrations where they redirect you to Koha, you consent and gives access to particular scopes, and then it redirects you back to the third-party system. And they act on behalf of you as the user but within your context as a user.

So those API calls could place holds but only for you as an authenticated user.
Comment 3 David Cook 2024-04-24 06:16:22 UTC
Created attachment 165447 [details] [review]
Bug 36561: Add "validate_borrowers" permission for /api/v1/auth/password/validation

This change adds a "validate_borrowers" permission which allows a user to only
validate borrowers by using the /api/v1/auth/password/validation endpoint.

This avoids scenarios where you want third-parties to authenticate a user without
giving them full permissions to perform CRUD operations on user data.

To test:
1. Apply patch
2. Run "koha-upgrade-schema kohadev"
3. koha-plack --reload kohadev
4. prove -v t/db_dependent/api/v1/password_validation.t
5. Visit http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=51
6. Note that a new subpermission "validate_borrowers" appears under the
"borrowers" permission
Comment 4 David Cook 2024-04-24 06:18:25 UTC
(In reply to David Cook from comment #1)
> Maybe this endpoint just needs a subpermission of "validate_borrowers". 
> 
> That would be a very easy change to make, and it would be backwards
> compatible, since "borrowers: 1" would already include "validate_borrowers". 

This is the option I've opted for, since it was the most straightforward and backwards compatible.
Comment 5 David Nind 2024-04-26 09:35:07 UTC
Hi David.

I'm not seeing the permission. All I see under "Add, modify and view patron information (borrowers)" are:

 Delete patrons (delete_borrowers)
 Add, modify and view patron information (edit_borrowers)
 Search, list and view patrons (list_borrowers)

I see the new permission if I do a reset_all in KTD.

Otherwise, as far as I can tell, step 2 of the test plan isn't doing anything (for me anyway).

Does this means it needs a database update for existing installations? Not really sure how that should work...

David
Comment 6 David Cook 2024-04-29 00:37:19 UTC
(In reply to David Nind from comment #5)
> I'm not seeing the permission. All I see under "Add, modify and view patron
> information (borrowers)" are:

Thanks, David! It looks like I missed adding the database update to the commit!
Comment 7 David Cook 2024-04-29 00:38:30 UTC
Created attachment 165713 [details] [review]
Bug 36561: Add "validate_borrowers" permission for /api/v1/auth/password/validation

This change adds a "validate_borrowers" permission which allows a user to only
validate borrowers by using the /api/v1/auth/password/validation endpoint.

This avoids scenarios where you want third-parties to authenticate a user without
giving them full permissions to perform CRUD operations on user data.

To test:
1. Apply patch
2. Run "koha-upgrade-schema kohadev"
3. koha-plack --reload kohadev
4. prove -v t/db_dependent/api/v1/password_validation.t
5. Visit http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=51
6. Note that a new subpermission "validate_borrowers" appears under the
"borrowers" permission
Comment 8 David Nind 2024-04-29 04:22:48 UTC
Created attachment 165718 [details] [review]
Bug 36561: Add "validate_borrowers" permission for /api/v1/auth/password/validation

This change adds a "validate_borrowers" permission which allows a user to only
validate borrowers by using the /api/v1/auth/password/validation endpoint.

This avoids scenarios where you want third-parties to authenticate a user without
giving them full permissions to perform CRUD operations on user data.

To test:
1. Apply patch
2. Run "koha-upgrade-schema kohadev"
3. koha-plack --reload kohadev
4. prove -v t/db_dependent/api/v1/password_validation.t
5. Visit http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=51
6. Note that a new subpermission "validate_borrowers" appears under the
"borrowers" permission

Signed-off-by: David Nind <david@davidnind.com>