https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42383 --- Comment #118 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 209778 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209778&action=edit Bug 42383: (QA follow-up) Require a token for checkin follow-up actions This patch makes the checkin follow-up endpoints require a short-lived signed token, issued when checking in, tied to the checkin, the staff member and the action: - POST /checkins/{checkin_id}/hold_confirmation - POST /checkins/{checkin_id}/hold_cancellation - POST /checkins/{checkin_id}/transfer_confirmation - POST /checkins/{checkin_id}/transfer_cancellation - POST /checkins/{checkin_id}/recall_confirmation It reuses the bug 24401 mechanism (Koha::Token generate_jwt/check_jwt, as for the checkin and checkout confirmation tokens). Changes: - Koha::Checkin->pending_actions returns the follow-up actions offered for the checkin (hold found, transfer triggered or needed, recall found) - Koha::Checkin->action_tokens returns a token for each of them, valid for 15 minutes (ACTION_TOKEN_EXPIRY_SECONDS) - Koha::Checkin->check_action_token validates a token - POST /checkins returns the tokens in a new 'action_tokens' attribute, an object keyed by action name - The endpoints above take a required 'action_token' query parameter, and return a 403 with the 'invalid_action_token' error_code when it is not valid for the checkin, user and action, or has expired - The check-in page passes the token of the action it performs Together with the stale checkin check, a checkin_id can no longer be used to alter holds, transfers or recalls outside of the check-in it was returned from. It addresses point 13 (b) of the QA comment. Test plan: 1. Apply this patch, rebuild the API bundle and the Vue files, and restart plack: $ ktd --shell k$ yarn api:bundle k$ yarn js:build k$ koha-plack --restart kohadev 2. Place a hold on an item, check it out to another patron 3. Check the item in on the check-in page and confirm the hold => SUCCESS: The hold is set waiting 4. Repeat 2 and 3, cancelling the hold instead => SUCCESS: The hold is cancelled 5. Repeat with a transfer and a recall => SUCCESS: They are confirmed/cancelled as expected 6. Run: k$ prove t/db_dependent/Koha/Checkin.t \ t/db_dependent/api/v1/checkins.t \ xt/api.t => SUCCESS: Tests pass! 7. Sign off :-D Assisted-by: Opus 5.5 (Anthropic) -- You are receiving this mail because: You are watching all bug changes.