June 2016 - Koha-bugs - lists.koha-community.org

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Johanna Räisä <johanna.raisa(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #52995|0 |1 is obsolete| | --- Comment #21 from Johanna Räisä <johanna.raisa(a)gmail.com> --- Created attachment 52996 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=52996&action=ed… [SIGNED-OFF] Bug 14868: Rename 'x-koha-permission' to 'x-koha-authorization' Since we need to be able to define other authorization options than simply Koha permissions, for example "allow-owner", we should rename x-koha-permission into x-koha-authorization to better describe the object. This patch simply renames all occurences of x-koha-permission into x-koha-authorization. The new specification for authorization: "/patrons/{borrowernumber}": { .. "x-koha-authorization": { "allow-owner": "1", "pemissions": { "borrowers": "1" } } } Signed-off-by: Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> My name is Olli-Antti Kivilahti and I approve this commit. We have been using the Swagger2.0-driven REST API on Mojolicious for 1 year now in production and I am certain we have a pretty good idea on how to work with the limitations of Swagger2.0 We participated in the development of the Mojolicious::Plugin::Swagger and know it well. We have made an extension to the plugin to provide full CORS support and have been building all our in-house features on the new REST API. Signed-off-by: Johanna Raisa <johanna.raisa(a)gmail.com> My name is Johanna Räisä and I approve this commit. We have been using Swagger2.0-driven REST API in production successfully. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 --- Comment #20 from Johanna Räisä <johanna.raisa(a)gmail.com> --- Created attachment 52995 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=52995&action=ed… [SIGNED-OFF] Bug 14868: Rename 'x-koha-permission' to 'x-koha-authorization' Since we need to be able to define other authorization options than simply Koha permissions, for example "allow-owner", we should rename x-koha-permission into x-koha-authorization to better describe the object. This patch simply renames all occurences of x-koha-permission into x-koha-authorization. The new specification for authorization: "/patrons/{borrowernumber}": { .. "x-koha-authorization": { "allow-owner": "1", "pemissions": { "borrowers": "1" } } } Signed-off-by: Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> My name is Olli-Antti Kivilahti and I approve this commit. We have been using the Swagger2.0-driven REST API on Mojolicious for 1 year now in production and I am certain we have a pretty good idea on how to work with the limitations of Swagger2.0 We participated in the development of the Mojolicious::Plugin::Swagger and know it well. We have made an extension to the plugin to provide full CORS support and have been building all our in-house features on the new REST API. Signed-off-by: Johanna Raisa <johanna.raisa(a)gmail.com> My name is Johanna Räisä and I approve this commit. We have been using Swagger2.0-driven REST API in production successfully. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 --- Comment #19 from Johanna Räisä <johanna.raisa(a)gmail.com> --- Created attachment 52994 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=52994&action=ed… [SIGNED-OFF] Bug 14868: Use x-koha-permission in current routes Adds missing permission checking to holds. Adds 6 tests to patrons.t, adds 30 tests to holds.t. Signed-off-by: Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> My name is Olli-Antti Kivilahti and I approve this commit. We have been using the Swagger2.0-driven REST API on Mojolicious for 1 year now in production and I am certain we have a pretty good idea on how to work with the limitations of Swagger2.0 We participated in the development of the Mojolicious::Plugin::Swagger and know it well. We have made an extension to the plugin to provide full CORS support and have been building all our in-house features on the new REST API. Signed-off-by: Johanna Raisa <johanna.raisa(a)gmail.com> My name is Johanna Räisä and I approve this commit. We have been using Swagger2.0-driven REST API in production successfully. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 --- Comment #18 from Johanna Räisä <johanna.raisa(a)gmail.com> --- Created attachment 52993 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=52993&action=ed… [SIGNED-OFF] Bug 14868: Give users possibility to request their own object If the user has no required permissions, but attempts to access his own object, allow this request in case "x-koha-permission" has defined "allow-owner": "1". As an example, the following resource can be accessed if user has borrowers-flag or if he is making the request to his own borrowernumber (in path or body): "/patrons/{borrowernumber}": { .. "x-koha-permission": { "allow-owner": "1", "permissions": { "borrowers": "1" } } } Signed-off-by: Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> My name is Olli-Antti Kivilahti and I approve this commit. We have been using the Swagger2.0-driven REST API on Mojolicious for 1 year now in production and I am certain we have a pretty good idea on how to work with the limitations of Swagger2.0 We participated in the development of the Mojolicious::Plugin::Swagger and know it well. We have made an extension to the plugin to provide full CORS support and have been building all our in-house features on the new REST API. Signed-off-by: Johanna Raisa <johanna.raisa(a)gmail.com> My name is Johanna Räisä and I approve this commit. We have been using Swagger2.0-driven REST API in production successfully. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Johanna Räisä <johanna.raisa(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #52981|0 |1 is obsolete| | --- Comment #17 from Johanna Räisä <johanna.raisa(a)gmail.com> --- Created attachment 52992 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=52992&action=ed… [SIGNED-OFF] Bug 14868: Swagger2-driven Permission checking A hasty downgrade from 13920, utilizing new features implemented by the Mojolicious::Plugin::Swagger2-author, to make it possible to implement more complex authentication/authorization scenarios with the Plugin. Define 'x-koha-permission' for the Swagger2 Operation Object, to automatically authorize against the required permissions. This way we immediately tell the API consumer in the Swagger2-definition, which permissions are needed to access defined resources. Also we don't need to maintain permissions in multiple locations and we can build a smart testing framework to help a lot in creating tests for the new REST API. Rebase notes from 2015-09-22 to 2016-06-20: - In patrons.t, change expected HTTP 403 to 401 when accessing the endpoint without authentication (401 = not authenticated, 403 = authenticated, but no permission). Signed-off-by: Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> My name is Olli-Antti Kivilahti and I approve this commit. We have been using the Swagger2.0-driven REST API on Mojolicious for 1 year now in production and I am certain we have a pretty good idea on how to work with the limitations of Swagger2.0 We participated in the development of the Mojolicious::Plugin::Swagger and know it well. We have made an extension to the plugin to provide full CORS support and have been building all our in-house features on the new REST API. Signed-off-by: Johanna Raisa <johanna.raisa(a)gmail.com> My name is Johanna Räisä and I approve this commit. We have been using Swagger2.0-driven REST API in production successfully. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 --- Comment #16 from Johanna Räisä <johanna.raisa(a)gmail.com> --- Created attachment 52981 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=52981&action=ed… [SIGNED-OFF] Bug 14868: Swagger2-driven Permission checking A hasty downgrade from 13920, utilizing new features implemented by the Mojolicious::Plugin::Swagger2-author, to make it possible to implement more complex authentication/authorization scenarios with the Plugin. Define 'x-koha-permission' for the Swagger2 Operation Object, to automatically authorize against the required permissions. This way we immediately tell the API consumer in the Swagger2-definition, which permissions are needed to access defined resources. Also we don't need to maintain permissions in multiple locations and we can build a smart testing framework to help a lot in creating tests for the new REST API. Rebase notes from 2015-09-22 to 2016-06-20: - In patrons.t, change expected HTTP 403 to 401 when accessing the endpoint without authentication (401 = not authenticated, 403 = authenticated, but no permission). Signed-off-by: Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> My name is Olli-Antti Kivilahti and I approve this commit. We have been using the Swagger2.0-driven REST API on Mojolicious for 1 year now in production and I am certain we have a pretty good idea on how to work with the limitations of Swagger2.0 We participated in the development of the Mojolicious::Plugin::Swagger and know it well. We have made an extension to the plugin to provide full CORS support and have been building all our in-house features on the new REST API. Signed-off-by: Johanna Raisa <johanna.raisa(a)gmail.com> My name is Johanna Räisä and I approve this commit. We have been using Swagger2.0-driven REST API in production successfully. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 12996] Tool to bulk export patrons images
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12996 Owen Leonard <oleonard(a)myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aidasarg(a)ysu.am --- Comment #1 from Owen Leonard <oleonard(a)myacpl.org> --- *** Bug 13126 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13126] Batch export patron images
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13126 Owen Leonard <oleonard(a)myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |DUPLICATE --- Comment #2 from Owen Leonard <oleonard(a)myacpl.org> --- *** This bug has been marked as a duplicate of bug 12996 *** -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #52963|0 |1 is obsolete| | --- Comment #15 from Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> --- Created attachment 52967 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=52967&action=ed… Bug 14868: Rename 'x-koha-permission' to 'x-koha-authorization' Since we need to be able to define other authorization options than simply Koha permissions, for example "allow-owner", we should rename x-koha-permission into x-koha-authorization to better describe the object. This patch simply renames all occurences of x-koha-permission into x-koha-authorization. The new specification for authorization: "/patrons/{borrowernumber}": { .. "x-koha-authorization": { "allow-owner": "1", "pemissions": { "borrowers": "1" } } } Signed-off-by: Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> My name is Olli-Antti Kivilahti and I approve this commit. We have been using the Swagger2.0-driven REST API on Mojolicious for 1 year now in production and I am certain we have a pretty good idea on how to work with the limitations of Swagger2.0 We participated in the development of the Mojolicious::Plugin::Swagger and know it well. We have made an extension to the plugin to provide full CORS support and have been building all our in-house features on the new REST API. -- You are receiving this mail because: You are watching all bug changes.

1 0