https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42383 --- Comment #62 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 209613 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209613&action=edit Bug 42383: (QA follow-up) Send module policies as plain JSON This patch drops the JWT serialization of module policies. The policy was signed with Koha::Token->encode_claims and sent in the X-Koha-Module-Policy header on some error responses, but nothing ever verified the signature: the page bootstraps from the plain JSON policy injected by circ/checkin.tt, and the client just base64-decoded the JWT payload. The signature added complexity and suggested a guarantee that did not exist. The policy is informational (the server validates every action), so it is now sent as a plain JSON object in the X-Koha-Module-Policy header, the same representation the page is bootstrapped with: - Koha::Module::Policy->as_jwt is removed - Koha::REST::Plugin::Policy sets the header to the JSON-encoded to_hashref - The check-in page parses the header as JSON - POD, OpenAPI header descriptions and tests are updated Koha::Token->encode_claims and decode_claims are kept, as the bug 24401 availability tokens use them. It addresses point 23 of the QA comment. Test plan: 1. Apply this patch, rebuild the API bundle and the Vue files, and restart plack: $ ktd --shell k$ yarn api:bundle k$ yarn js:build k$ koha-plack --restart kohadev 2. Log in as a staff member with the writeoff permission, open the check-in page and tick 'Forgive overdue charges' 3. In another tab, remove the updatecharges > writeoff permission from that staff member 4. Check in a checked out item on the first tab => SUCCESS: The check-in is refused and the 'Forgive overdue charges' option is no longer offered 5. Run: k$ prove t/db_dependent/Koha/Module/Policy.t \ t/db_dependent/Koha/Module/Policy/Checkin.t \ t/db_dependent/Koha/REST/Plugin/Policy.t \ t/db_dependent/api/v1/checkins.t \ xt/api.t => SUCCESS: Tests pass! 6. Sign off :-D Assisted-by: Opus 5.5 (Anthropic) -- You are receiving this mail because: You are watching all bug changes.