June 2016 - Koha-bugs - lists.koha-community.org

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #52604|0 |1 is obsolete| | --- Comment #14 from Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> --- Created attachment 52966 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=52966&action=ed… Bug 14868: Use x-koha-permission in current routes Adds missing permission checking to holds. Adds 6 tests to patrons.t, adds 30 tests to holds.t. Signed-off-by: Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> My name is Olli-Antti Kivilahti and I approve this commit. We have been using the Swagger2.0-driven REST API on Mojolicious for 1 year now in production and I am certain we have a pretty good idea on how to work with the limitations of Swagger2.0 We participated in the development of the Mojolicious::Plugin::Swagger and know it well. We have made an extension to the plugin to provide full CORS support and have been building all our in-house features on the new REST API. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #52603|0 |1 is obsolete| | --- Comment #13 from Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> --- Created attachment 52965 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=52965&action=ed… Bug 14868: Give users possibility to request their own object If the user has no required permissions, but attempts to access his own object, allow this request in case "x-koha-permission" has defined "allow-owner": "1". As an example, the following resource can be accessed if user has borrowers-flag or if he is making the request to his own borrowernumber (in path or body): "/patrons/{borrowernumber}": { .. "x-koha-permission": { "allow-owner": "1", "permissions": { "borrowers": "1" } } } Signed-off-by: Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> My name is Olli-Antti Kivilahti and I approve this commit. We have been using the Swagger2.0-driven REST API on Mojolicious for 1 year now in production and I am certain we have a pretty good idea on how to work with the limitations of Swagger2.0 We participated in the development of the Mojolicious::Plugin::Swagger and know it well. We have made an extension to the plugin to provide full CORS support and have been building all our in-house features on the new REST API. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #52602|0 |1 is obsolete| | --- Comment #12 from Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> --- Created attachment 52964 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=52964&action=ed… Bug 14868: Swagger2-driven Permission checking A hasty downgrade from 13920, utilizing new features implemented by the Mojolicious::Plugin::Swagger2-author, to make it possible to implement more complex authentication/authorization scenarios with the Plugin. Define 'x-koha-permission' for the Swagger2 Operation Object, to automatically authorize against the required permissions. This way we immediately tell the API consumer in the Swagger2-definition, which permissions are needed to access defined resources. Also we don't need to maintain permissions in multiple locations and we can build a smart testing framework to help a lot in creating tests for the new REST API. Rebase notes from 2015-09-22 to 2016-06-20: - In patrons.t, change expected HTTP 403 to 401 when accessing the endpoint without authentication (401 = not authenticated, 403 = authenticated, but no permission). Signed-off-by: Olli-Antti Kivilahti <olli-antti.kivilahti(a)jns.fi> My name is Olli-Antti Kivilahti and I approve this commit. We have been using the Swagger2.0-driven REST API on Mojolicious for 1 year now in production and I am certain we have a pretty good idea on how to work with the limitations of Swagger2.0 We participated in the development of the Mojolicious::Plugin::Swagger and know it well. We have made an extension to the plugin to provide full CORS support and have been building all our in-house features on the new REST API. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 --- Comment #11 from Lari Taskula <larit(a)student.uef.fi> --- Created attachment 52963 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=52963&action=ed… Bug 14868: Rename 'x-koha-permission' to 'x-koha-authorization' Since we need to be able to define other authorization options than simply Koha permissions, for example "allow-owner", we should rename x-koha-permission into x-koha-authorization to better describe the object. This patch simply renames all occurences of x-koha-permission into x-koha-authorization. The new specification for authorization: "/patrons/{borrowernumber}": { .. "x-koha-authorization": { "allow-owner": "1", "pemissions": { "borrowers": "1" } } } -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15006] Need to distinguish client timeout from login timeout
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15006 --- Comment #40 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- (In reply to Colin Campbell from comment #39) > A problem is the timeout send back in acs_status is a transaction timeout. > Strictly when that timeout elapses the client sould revert the current > transaction but the connection should be maintained. There is of course > already a timeout on the connection at tcp level if you are using keep alives OK That is clear. So we indeed need another one. This transaction timeout could perhaps be placed at a more logical place in the config? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15006] Need to distinguish client timeout from login timeout
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15006 --- Comment #39 from Colin Campbell <colin.campbell(a)ptfs-europe.com> --- (In reply to Marcel de Rooy from comment #22) > Created attachment 52480 [details] [review] > Bug 15006: [COUNTERPATCH] Timeout logic in sip_protocol_loop > > Instead of adding yet another client timeout, I propose to use the > policy timeout that we also communicate in send_acs_status. > Although I agree that we perhaps better move it from institution to > account/login level, this c/should be done on another report. We > may have issues with existing configurations. > > In order to find a compromise between bug 13432 and the originally > proposed 15006 patch, this patch allows you to put a zero in the > policy timeout entry in the SIPconfig. > > The timeout logic is moved to a Sip.pm subroutine. Will add a test :) > > Test plan: > [1] Check timeout after login with policy/timeout > 0. > [2] Check timeout after login with policy/timeout = 0. (No timeout!) > [3] Check timeout after login with no policy timeout. Fallback to service. > [4] Check timeout after login with no policy and service timeout. > Should fallback to 30 seconds for both login process and after login. > > Signed-off-by: Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> A problem is the timeout send back in acs_status is a transaction timeout. Strictly when that timeout elapses the client sould revert the current transaction but the connection should be maintained. There is of course already a timeout on the connection at tcp level if you are using keep alives -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15006] Need to distinguish client timeout from login timeout
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15006 --- Comment #38 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- (In reply to Colin Campbell from comment #37) > (In reply to Kyle M Hall from comment #34) > > I like this proposal, but I think we should get Colin's testing and input > > before setting it to Passed QA. > > It was me saying I'll test --- I was masquerading as Martin Secure passwords :) Thx. Could you also have a look at comment26 ? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15006] Need to distinguish client timeout from login timeout
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15006 --- Comment #37 from Colin Campbell <colin.campbell(a)ptfs-europe.com> --- (In reply to Kyle M Hall from comment #34) > I like this proposal, but I think we should get Colin's testing and input > before setting it to Passed QA. It was me saying I'll test --- I was masquerading as Martin -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 11210] Allow partial writeoff
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11210 Mike <black23(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |black23(a)gmail.com, | |josef.moravec(a)gmail.com -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14827] Merge various subroutines for paying fees into one
by bugzilla-daemon＠bugs.koha-community.org 30 Jun '16

30 Jun '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14827 Mike <black23(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |black23(a)gmail.com, | |mail(a)jkozlovsky.cz -- You are receiving this mail because: You are watching all bug changes.

1 0