Bug 40441 - /auth/password/validation ( validateUserAndPassword ) requires too much permissions
Summary: /auth/password/validation ( validateUserAndPassword ) requires too much permi...
Status: RESOLVED DUPLICATE of bug 36561
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Tomás Cohen Arazi (tcohen)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-07-17 21:03 UTC by Lucas Gass (lukeg)
Modified: 2025-07-24 12:21 UTC (History)
2 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 40441: Add new permission api_validate_password (3.55 KB, patch)
2025-07-24 12:20 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 40441: Make /auth/password/validation use new permission (1010 bytes, patch)
2025-07-24 12:20 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Lucas Gass (lukeg) 2025-07-17 21:03:06 UTC
In the API swagger definition for validateUserAndPassword: 


1184     x-koha-authorization:
1185       permissions:
1186         borrowers: "1"

Requiring the top level permission is more than should be needed. It shouldn't need delete_borrowers or send_messages_to_borrowers. 

We should add a new sub-permission for borrowers like 'api_validate_password'
Comment 1 David Cook 2025-07-23 23:07:09 UTC
I agree. I have patches on bug 36561. Can you take a look there?

I think Katrin marked it as Failed QA from Passed QA, although I don't know why.

*** This bug has been marked as a duplicate of bug 36561 ***
Comment 2 Tomás Cohen Arazi (tcohen) 2025-07-24 12:20:25 UTC
Created attachment 184588 [details] [review]
Bug 40441: Add new permission api_validate_password

This patch adds a new permission 'api_validate_password' that will be used
to control access to the /auth/password/validation endpoint.

The permission is added to:
- userpermissions.sql for new installations
- permissions.inc for display in the staff interface
- atomic update script for existing installations

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 3 Tomás Cohen Arazi (tcohen) 2025-07-24 12:20:28 UTC
Created attachment 184589 [details] [review]
Bug 40441: Make /auth/password/validation use new permission

This patch updates the /auth/password/validation endpoint to use the new
api_validate_password permission instead of the generic borrowers
permission.

This provides more granular control over who can use the password
validation API endpoint.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 4 Tomás Cohen Arazi (tcohen) 2025-07-24 12:21:38 UTC
(In reply to David Cook from comment #1)
> I agree. I have patches on bug 36561. Can you take a look there?
> 
> I think Katrin marked it as Failed QA from Passed QA, although I don't know
> why.
> 
> *** This bug has been marked as a duplicate of bug 36561 ***

Oops. Will do. Do you think we could go with my permission name/description? I believe is more accurate on the scope.