https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42926 --- Comment #1 from Thibaud Guillot (thibaud_g) <thibaud.guillot@biblibre.com> --- Created attachment 201055 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=201055&action=edit Bug 42926: REST API - Return passwordmustchange flag when patron password is expired When a patron's password is expired (whether due to ForcePasswordResetWhenSetByStaff or natural expiration), the REST API now returns a structured 403 response with a `passwordmustchange` boolean flag. Before: - Basic auth returned 403 "Password has expired" - Cookie session with an expired password fell through to "Unexpected authentication status" After: - Both auth methods return 403 { "error": "Password must be changed", "passwordmustchange": true } - A dedicated Koha::Exceptions::Authentication::PasswordMustChange exception handles this case Test plan: 1. Enable syspref RESTBasicAuth 2. Create a patron with a password 3. Set password_expiration_date to yesterday: UPDATE borrowers SET password_expiration_date = DATE_SUB(NOW(), INTERVAL 1 DAY) WHERE userid = 'testuser'; 4. HTTP 403 with "passwordmustchange:true" into the body GET /api/v1/patrons 5. Enable syspref ForcePasswordResetWhenSetByStaff 6. Create a new patron WITH a password via the full patron add form (not quick add to set password during creation, not separately) 7. HTTP 403 with "passwordmustchange:true" into the body GET /api/v1/patrons 8. With the expired patron from step 3: POST /api/v1/public/patrons/{patron_id}/password via Basic auth Body: { "old_password": "...", "password": "NewPass!", "password_repeated": "NewPass!" } 9. HTTP 200 on GET /api/v1/patrons with new password prove -v t/db_dependent/api/v1/auth_basic.t Sponsored-by: BibLibre -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42926 Thibaud Guillot (thibaud_g) <thibaud.guillot@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Sponsorship status|--- |Sponsored -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42926 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |tomascohen@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42926 Thibaud Guillot (thibaud_g) <thibaud.guillot@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42926 --- Comment #5 from Thibaud Guillot (thibaud_g) <thibaud.guillot@biblibre.com> --- Thanks for the review! 1) Now using error_code => 'password_expired' instead of adding a new attribute to the error object schema, and the message reads 'Password expired'. 2) Exception renamed to Koha::Exceptions::Password::Expired, moved to Koha/Exceptions/Password.pm with the other password-related exceptions. 3) Unchanged, as you confirmed it looks good. -- You are receiving this mail because: You are watching all bug changes.