Today I was looking to replace a third-party's usage of ILS-DI AuthenticatePatron with the REST API's "/api/v1/auth/password/validation", when I realized that it would mean giving the third-party much greater Koha permission than they currently have. "/api/v1/auth/password/validation" requires the "borrowers" permission, which gives you full access to all borrower data. I don't think that's what we want to give a third-party that really just needs to validate that a patron is an authentic member of Koha. I think that we might need a new permission class. I don't have a perfect name for it yet, but I'm thinking about it. Here's some ideas: - Discovery - External - API - Web services - Third-party -- That way, we can have third-party API users that are narrowly scoped to just what they need to do.
Then again... maybe I'm wrong. Maybe this endpoint just needs a subpermission of "validate_borrowers". That would be a very easy change to make, and it would be backwards compatible, since "borrowers: 1" would already include "validate_borrowers". -- Of course, at some point, we'd need an ILS-DI GetPatronInfo replacement which doesn't reveal everything about the patron, but gives a third-party system enough to work with. Martin has been interested in this topic in terms of scopes that users consent to.
Of course, part of the issue for these third-party systems is that their API user does things "outside of the context of a user". It would be great to have integrations where they redirect you to Koha, you consent and gives access to particular scopes, and then it redirects you back to the third-party system. And they act on behalf of you as the user but within your context as a user. So those API calls could place holds but only for you as an authenticated user.
Created attachment 165447 [details] [review] Bug 36561: Add "validate_borrowers" permission for /api/v1/auth/password/validation This change adds a "validate_borrowers" permission which allows a user to only validate borrowers by using the /api/v1/auth/password/validation endpoint. This avoids scenarios where you want third-parties to authenticate a user without giving them full permissions to perform CRUD operations on user data. To test: 1. Apply patch 2. Run "koha-upgrade-schema kohadev" 3. koha-plack --reload kohadev 4. prove -v t/db_dependent/api/v1/password_validation.t 5. Visit http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=51 6. Note that a new subpermission "validate_borrowers" appears under the "borrowers" permission
(In reply to David Cook from comment #1) > Maybe this endpoint just needs a subpermission of "validate_borrowers". > > That would be a very easy change to make, and it would be backwards > compatible, since "borrowers: 1" would already include "validate_borrowers". This is the option I've opted for, since it was the most straightforward and backwards compatible.
Hi David. I'm not seeing the permission. All I see under "Add, modify and view patron information (borrowers)" are: Delete patrons (delete_borrowers) Add, modify and view patron information (edit_borrowers) Search, list and view patrons (list_borrowers) I see the new permission if I do a reset_all in KTD. Otherwise, as far as I can tell, step 2 of the test plan isn't doing anything (for me anyway). Does this means it needs a database update for existing installations? Not really sure how that should work... David
(In reply to David Nind from comment #5) > I'm not seeing the permission. All I see under "Add, modify and view patron > information (borrowers)" are: Thanks, David! It looks like I missed adding the database update to the commit!
Created attachment 165713 [details] [review] Bug 36561: Add "validate_borrowers" permission for /api/v1/auth/password/validation This change adds a "validate_borrowers" permission which allows a user to only validate borrowers by using the /api/v1/auth/password/validation endpoint. This avoids scenarios where you want third-parties to authenticate a user without giving them full permissions to perform CRUD operations on user data. To test: 1. Apply patch 2. Run "koha-upgrade-schema kohadev" 3. koha-plack --reload kohadev 4. prove -v t/db_dependent/api/v1/password_validation.t 5. Visit http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=51 6. Note that a new subpermission "validate_borrowers" appears under the "borrowers" permission
Created attachment 165718 [details] [review] Bug 36561: Add "validate_borrowers" permission for /api/v1/auth/password/validation This change adds a "validate_borrowers" permission which allows a user to only validate borrowers by using the /api/v1/auth/password/validation endpoint. This avoids scenarios where you want third-parties to authenticate a user without giving them full permissions to perform CRUD operations on user data. To test: 1. Apply patch 2. Run "koha-upgrade-schema kohadev" 3. koha-plack --reload kohadev 4. prove -v t/db_dependent/api/v1/password_validation.t 5. Visit http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=51 6. Note that a new subpermission "validate_borrowers" appears under the "borrowers" permission Signed-off-by: David Nind <david@davidnind.com>