https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38745 --- Comment #14 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- I have taken this proof of concept forward into a first real submission, rebased on current main, and obsoleted the two original patches. What the patches do: * Add POST /api/v1/rpc, a JSON-RPC 2.0 endpoint. Only methods in an explicit registry (Koha::RPC) can be called, there is no dispatch by Perl package name any more. * Each method declares its params schema and the permissions it requires in the API spec, and the router checks them per method (permissions first, so users without access learn nothing about the params). Swagger 2.0 has no oneOf and the spec validator rejects it, so this lives in an x-rpc-methods extension of the rpc_request definition, to become a oneOf once we migrate to OpenAPI 3 (bug 35613). * Every failure after authentication (parse error, invalid request, unknown method, invalid params, permission denied, method specific errors) is returned as a JSON-RPC error object. Batch requests and notifications are rejected for now. * authorize_user is extracted from authenticate_api_request so the permission check can be reused. * The first method is biblios.populate_empty_callnumbers, ported from bug 38226 with the logic moved into Koha::Biblio->populate_empty_callnumbers. This addresses the concerns in comment 4: permissions are applied per method rather than for the whole router, and methods are not resolved dynamically. To test: apply the patches, enable RESTBasicAuth, set itemcallnumber to 082ab, create a biblio with an 082 field and items without a callnumber, and POST {"jsonrpc":"2.0","method":"biblios.populate_empty_callnumbers","params":{"biblio_id":<id>},"id":1} to /api/v1/rpc as a user with edit_catalogue. Repeat as a user without it. Tests: prove t/db_dependent/api/v1/rpc.t t/db_dependent/Koha/RPC.t t/db_dependent/Koha/Biblio.t t/db_dependent/api/v1/auth.t and xt/api.t. -- You are receiving this mail because: You are watching all bug changes.