September 2016 - Koha-bugs - lists.koha-community.org

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 01 Sep '16

01 Sep '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Benjamin Rokseth <benjamin.rokseth(a)kul.oslo.kommune.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #55085|0 |1 is obsolete| | --- Comment #51 from Benjamin Rokseth <benjamin.rokseth(a)kul.oslo.kommune.no> --- Created attachment 55101 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=55101&action=ed… Bug 14868: Give users possibility to request their own object Allow access to user's own objects even if they do not have required permissions. This will be very useful in many cases where an user wants to request their own object, for example renewing their checkouts or placing a hold for themselves. First, this patch renames "x-koha-permission" to "x-koha-authorization" in order to describe the new functionality better. Second, we can now add two extra parameters under "x-koha-authorization": - "allow-owner"; Allows the owner of object to access it (without permission) - "allow-guarantor"; Allows guarantor of the owner of object to access it (without permission) Third, since permission checking is outside of actual controller, we need a way to find out ownership from different types of parameters, e.g. checkout_id from /checkouts/{checkout_id}, borrowernumber from /patrons/{borrowernumber} etc. A solution is to match the parameter with a subroutine that is designed to verify the ownership for that object. See the new subroutines in Koha::REST::V1. To use this functionality you will simply define it in Swagger: "/patrons/{borrowernumber}": { "get": { ..., "x-koha-authorization": { "allow-owner": true, "permissions": { "borrowers": "1" } } } } If a parameter that is not yet defined in Koha::REST::V1::check_object_ownership, you also need to define it and implement a subroutine that determines ownership. Tests are provided in a following patch that adds this functionality for current API operations. Signed-off-by: Benjamin Rokseth <benjamin.rokseth(a)kul.oslo.kommune.no> Signed-off-by: Tomas Cohen Arazi <tomascohen(a)theke.io> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 01 Sep '16

01 Sep '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Benjamin Rokseth <benjamin.rokseth(a)kul.oslo.kommune.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #55084|0 |1 is obsolete| | --- Comment #50 from Benjamin Rokseth <benjamin.rokseth(a)kul.oslo.kommune.no> --- Created attachment 55100 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=55100&action=ed… Bug 14868: Swagger2-driven Permission checking Define 'x-koha-permission' for the Swagger2 Operation Object, to automatically authorize against the required permissions. This way we immediately tell the API consumer in the Swagger2-definition, which permissions are needed to access defined resources. Also we don't need to maintain permissions in multiple locations and we can build a smart testing framework to help a lot in creating tests for the new REST API. Signed-off-by: Benjamin Rokseth <benjamin.rokseth(a)kul.oslo.kommune.no> Signed-off-by: Tomas Cohen Arazi <tomascohen(a)theke.io> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14868] REST API: Swagger2-driven permission checking
by bugzilla-daemon＠bugs.koha-community.org 01 Sep '16

01 Sep '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868 Benjamin Rokseth <benjamin.rokseth(a)kul.oslo.kommune.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #55087|0 |1 is obsolete| | --- Comment #49 from Benjamin Rokseth <benjamin.rokseth(a)kul.oslo.kommune.no> --- Created attachment 55099 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=55099&action=ed… Bug 14868: Display required permissions in permission error response When user does not have required permissions to use API operation, it would be useful to let them know which permissions he is missing. Since they are now defined in Swagger, we can easily render them into the response. To test: 1. Use a patron without any permissions 2. Make GET request to http://yourlib/api/v1/patrons 3. Observe permission error and see that required_permissions are displayed. 4. Run t/db_dependent/api/v1/patrons.t Signed-off-by: Benjamin Rokseth <benjamin.rokseth(a)kul.oslo.kommune.no> Signed-off-by: Tomas Cohen Arazi <tomascohen(a)theke.io> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 9093] 008 forgetting what material type was chosen
by bugzilla-daemon＠bugs.koha-community.org 01 Sep '16

01 Sep '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9093 Jacek Ablewicz <abl(a)biblos.pk.edu.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=17072 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15503] Grab Item Information from Order Files
by bugzilla-daemon＠bugs.koha-community.org 01 Sep '16

01 Sep '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15503 --- Comment #17 from Kyle M Hall <kyle(a)bywatersolutions.com> --- > However, and this might be tangential, the authorized value does not appear > to be updating when either creating the items or receiving them. Currently > acquisitions would place a record in an Ordered NOT_LOAN status. This may be > a local script, but it does not appear to be syspref. When we create an > order using acquisitions in the sandbox, the items appear as available. Just thought I'd chime in on this. Benjamin, this works because in your ACQ marc framework, you have 952$7 ( not for loan ) set to have a default value of -1, which in your NOT_LOAN authorised value list is "Ordered". So I don't think this is an issue with this patch. > Additionally, if we do set AcqItemSetSubfieldsWhenReceived in the system > preferences, receiving the items does not seem to update the subfields. I > know this works in production, but does appear broken here. This patch doesn't really affect receiving items either. It's most likely an independent regression. It may be worth your time to create a sandbox on master with no patches applied to test this. If it still doesn't work you can file a new bug report for that! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15388] Show Syndetics covers by UPC in search results
by bugzilla-daemon＠bugs.koha-community.org 01 Sep '16

01 Sep '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15388 Kyle M Hall <kyle(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle(a)bywatersolutions.com Attachment #54940|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

1 0