https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Add public route to get a |Add unprivileged route to |bibliographic record |get a bibliographic record -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 --- Comment #3 from Tomás Cohen Arazi <tomascohen@gmail.com> --- This one is about the OPAC. I think you mean the other bug (24908). But you are right about that. I want to introduce new things to the API and deprecate the old scripts. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 --- Comment #4 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 101057 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=101057&action=edit Bug 24909: Unit tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 --- Comment #6 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 101059 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=101059&action=edit Bug 24909: Add unprivileged route to get a bibliographic record This patch adds a route to get bibliographic records without privileged access. This needs to match the OPAC expected behaviour. Some things were considered on the implementation: - The ViewPolicy filter that hides/shows things based on the frameworks needded to be used, as in the OPAC. - OpacHiddenItems and OpacHiddenItemsExceptions need to be considered for hiding records the same way the OPAC is expected to. - Avoid using OpacHiddenItemsExceptions, but rely on the patron category instead (use Koha::Patron::Category->override_hidden_items abstraction is used instead so it should keep working once 22547 is moved forward). - Tests should cover all the use cases: * logged in user * anonymous user * logged in with category that overrides * logged in with category that doesn't override This is all implemented on the tests. To test: 1. Apply the tests patch 2. Run: $ kshell k$ prove t/db_dependent/api/v1/biblios.t => FAIL: Route not implemented 3. Apply the rest of the patches 4. Repeat 2 => SUCCESS: Tests pass! 5. Try it with your favourite API tool (Postman?) 6. Sign off :-D Note: please notice there isn't a default fallback behaviour for when you don't specify the Accept header, so testing this on a regular browser will just print the accepted mime types instead of the record itself. To test this with a tool (like Postman) you should enable RESTBasicAuthe and make the tool use Basic authentication with valid credentials. And you need to specify any of the following strings on the Accept header: - application/marcxml+xml - application/marc-in-json - application/marc - text/plain -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #101057|0 |1 is obsolete| | --- Comment #7 from David Nind <david@davidnind.com> --- Created attachment 102163 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=102163&action=edit Bug 24909: Unit tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #101059|0 |1 is obsolete| | --- Comment #9 from David Nind <david@davidnind.com> --- Created attachment 102165 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=102165&action=edit Bug 24909: Add unprivileged route to get a bibliographic record This patch adds a route to get bibliographic records without privileged access. This needs to match the OPAC expected behaviour. Some things were considered on the implementation: - The ViewPolicy filter that hides/shows things based on the frameworks needded to be used, as in the OPAC. - OpacHiddenItems and OpacHiddenItemsExceptions need to be considered for hiding records the same way the OPAC is expected to. - Avoid using OpacHiddenItemsExceptions, but rely on the patron category instead (use Koha::Patron::Category->override_hidden_items abstraction is used instead so it should keep working once 22547 is moved forward). - Tests should cover all the use cases: * logged in user * anonymous user * logged in with category that overrides * logged in with category that doesn't override This is all implemented on the tests. To test: 1. Apply the tests patch 2. Run: $ kshell k$ prove t/db_dependent/api/v1/biblios.t => FAIL: Route not implemented 3. Apply the rest of the patches 4. Repeat 2 => SUCCESS: Tests pass! 5. Try it with your favourite API tool (Postman?) 6. Sign off :-D Note: please notice there isn't a default fallback behaviour for when you don't specify the Accept header, so testing this on a regular browser will just print the accepted mime types instead of the record itself. To test this with a tool (like Postman) you should enable RESTBasicAuthe and make the tool use Basic authentication with valid credentials. And you need to specify any of the following strings on the Accept header: - application/marcxml+xml - application/marc-in-json - application/marc - text/plain Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 --- Comment #11 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to David Nind from comment #10)

Note: text/plain is not an available option for Accept header.

Right, I can write a follow-up for that. I wrote that for the privileged access API before writing this one! -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 --- Comment #12 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- What happens if OpacPublic is disabled? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 --- Comment #14 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Jonathan Druart from comment #12)

What happens if OpacPublic is disabled?

Nothing. All routes that are in the /public namespace can be disabled using the RESTPublicAPI syspref. We are not going to add tests for that in this bug, as it is tested generally in t/db_dependent/api/auth.t:50 onwards (bug 22061). -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |25045 See Also|https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=25045 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25045 [Bug 25045] Add a way to restrict anonymous access to public routes (OpacPublic behaviour) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off --- Comment #16 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Jonathan Druart from comment #15)

(In reply to Tomás Cohen Arazi from comment #11)

...

(In reply to David Nind from comment #10)

...

Note: text/plain is not an available option for Accept header.

Right, I can write a follow-up for that. I wrote that for the privileged access API before writing this one!

Waiting for the follow-up.

This route correctly implements Accept: text/plain, already. So back to SO. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #102163|0 |1 is obsolete| | Attachment #102164|0 |1 is obsolete| | Attachment #102165|0 |1 is obsolete| | --- Comment #17 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 103672 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=103672&action=edit Bug 24909: Unit tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 --- Comment #19 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 103674 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=103674&action=edit Bug 24909: Add unprivileged route to get a bibliographic record This patch adds a route to get bibliographic records without privileged access. This needs to match the OPAC expected behaviour. Some things were considered on the implementation: - The ViewPolicy filter that hides/shows things based on the frameworks needded to be used, as in the OPAC. - OpacHiddenItems and OpacHiddenItemsExceptions need to be considered for hiding records the same way the OPAC is expected to. - Avoid using OpacHiddenItemsExceptions, but rely on the patron category instead (use Koha::Patron::Category->override_hidden_items abstraction is used instead so it should keep working once 22547 is moved forward). - Tests should cover all the use cases: * logged in user * anonymous user * logged in with category that overrides * logged in with category that doesn't override This is all implemented on the tests. To test: 1. Apply the tests patch 2. Run: $ kshell k$ prove t/db_dependent/api/v1/biblios.t => FAIL: Route not implemented 3. Apply the rest of the patches 4. Repeat 2 => SUCCESS: Tests pass! 5. Try it with your favourite API tool (Postman?) 6. Sign off :-D Note: please notice there isn't a default fallback behaviour for when you don't specify the Accept header, so testing this on a regular browser will just print the accepted mime types instead of the record itself. To test this with a tool (like Postman) you should enable RESTBasicAuthe and make the tool use Basic authentication with valid credentials. And you need to specify any of the following strings on the Accept header: - application/marcxml+xml - application/marc-in-json - application/marc - text/plain Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 --- Comment #20 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Nice work everyone! Pushed to master for 20.05 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|new feature |enhancement CC| |martin.renvoize@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |Pushed to stable CC| |aleisha@catalyst.net.nz -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 --- Comment #24 from Tomás Cohen Arazi <tomascohen@gmail.com> --- @aleisha: you should consider backporting bug 25045 and bug 25327 as well. It is your call, but we found out bug 25045 would be required during the QA round to allow disabling anonymous access. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 --- Comment #26 from Aleisha Amohia <aleisha@catalyst.net.nz> --- (In reply to Tomás Cohen Arazi from comment #24)

@aleisha: you should consider backporting bug 25045 and bug 25327 as well. It is your call, but we found out bug 25045 would be required during the QA round to allow disabling anonymous access.

not backporting 25045 to 19.11.x due to the db update -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24909 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |29890 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29890 [Bug 29890] Unprivileged route to bib records needs check on OpacSuppression -- You are receiving this mail because: You are watching all bug changes.