[Bug 36536] New: Make REST API's validateUserAndPassword update borrowers.lastseen
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Bug ID: 36536 Summary: Make REST API's validateUserAndPassword update borrowers.lastseen Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: REST API Assignee: koha-bugs@lists.koha-community.org Reporter: magnus@libriotech.no CC: tomascohen@gmail.com Since ILS-DI (which specifically means the AuthenticatePatron verb) is an option that can be selected for TrackLastPatronActivityTriggers, I would expect the validateUserAndPassword of the REST API to also contribute to updating borrowers.lastseen. Since there is no separate option for activalting it, I thought maybe the REST API is considered so much "core" to Koha that the logins are tracked when "Logging in" is activated as an option for TrackLastPatronActivityTriggers. But it looks like it is not. To reproduce in KTD: TrackLastPatronActivityTriggers = [Select all] RESTBasicAuth = Enable Check the lastseen value of the "koha" user in the database: select borrowernumber, lastseen from borrowers where borrowernumber = 51; The value should be NULL, or some past timestamp. Run this script: https://wiki.koha-community.org/wiki/REST_API:_Checking_username_and_passwor... Check the lastseen value of the "koha" user again. I would expect it to have been updated when the script ran, but it is not. Not sure if validateUserAndPassword should be considered as just another way of "Logging in", or if it should be a separate option for TrackLastPatronActivityTriggers, but the latter would give maximum flexibility. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Magnus Enger <magnus@libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |15504 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15504 [Bug 15504] Track Patron's Last Activity -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Sally <sally.healey@cheshiresharedservices.gov.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sally.healey@cheshireshared | |services.gov.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |Hackfest CC| |martin.renvoize@openfifth.c | |o.uk -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alexander.blanchard@openfif | |th.co.uk, | |chloe.zermatten@openfifth.c | |o.uk, | |jake.deery@openfifth.co.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CONFIRMED -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Chip Halvorsen <Chip.Halvorsen@WestlakeLibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Chip.Halvorsen@WestlakeLibr | |ary.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #1 from David Cook <dcook@prosentient.com.au> --- Hmm, makes sense, although I'd say the problem probably goes deeper. That is, the solution isn't to put it in the REST API but rather at the lower level successful authentication, so that it applies to all successful authentications regardless of controller. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=29900 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 CJ Lynce <cj.lynce@westlakelibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cj.lynce@westlakelibrary.or | |g -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 CJ Lynce <cj.lynce@westlakelibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |cj.lynce@westlakelibrary.or |ity.org |g --- Comment #2 from CJ Lynce <cj.lynce@westlakelibrary.org> --- Currently, the REST API 'patron login' is actually doing a verification of a username and password to be sure they are correct (checkpw). This is only a portion of the full authentication process in C4::Auth. Additionally, a 'verification' via API is not a full 'login' to Koha, but rather a login to whatever application is using the API (in most cases). I can see use cases when knowing when a patron is doing a full login to Koha versus when they are being verified via an API call. I agree that a larger rework may be needed for the lower level authentication system to accept a variety of 'login' paths, but for the time being, adding an update_lastseen option for the API is a very trivial addition for a big benefit. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 CJ Lynce <cj.lynce@westlakelibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CONFIRMED |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 --- Comment #3 from CJ Lynce <cj.lynce@westlakelibrary.org> --- Created attachment 185532 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=185532&action=edit Bug 36536: Make REST APIs validateUserAndPassword update borrowers.lastseen This patch added the option to update borrowers.lastseen when a patron username and password is verified via the REST API. This can be enabled or disabled selectively using the TrackLastPatronActivityTriggers system preference using the [ ] Patron authentication via API option.. To test: 1. Create a new user, ensuring to set the Username and password fields. *Import to do this first* 2. Edit the TrackLastPatronActivityTriggers syspref and check 'login 3. Ensure the RESTBasicAuth syspref is set to Enable. 4. Check the lastseen date of your new user using a SQL report SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid = 'USERNAME' (Replace USERNAME with your chosen username for the new patron) 5. The lastseen for your new user should be null 6. Run the attached api_verify_lastseen.pl test script **Change P_USERNAME and P_PASSWORD to the username and password of your new user. (script contains expected output for successful verification) 7. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should still be null. 8. Apply Patch 9. Edit the TrackLastPatronActivityTriggers syspref and check the '[ ] Patron authentication via API' option 10. Rerun the api_verify_lastseen.pl 11. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should now be updated to the time of the last script run. For good measure: 12. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** the '[ ] Patron authentication via API' option 13. Rerun the api_verify_lastseen.pl 14. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should have remained the same as previous. Sponsored-by: Westlake Porter Public Library <https://westlakelibrary.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 --- Comment #4 from CJ Lynce <cj.lynce@westlakelibrary.org> --- Created attachment 185534 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=185534&action=edit TESTING SCRIPT: api_verify_lastseen.pl Perl script for testing an API call to verify patron username and password. *Not part of patch* -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 CJ Lynce <cj.lynce@westlakelibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Change sponsored?|--- |Sponsored Status|ASSIGNED |Needs Signoff Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 CJ Lynce <cj.lynce@westlakelibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #185532|0 |1 is obsolete| | --- Comment #5 from CJ Lynce <cj.lynce@westlakelibrary.org> --- Created attachment 185582 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=185582&action=edit Bug 36536: Make REST APIs validateUserAndPassword update borrowers.lastseen This patch added the option to update borrowers.lastseen when a patron username and password is verified via the REST API. This can be enabled or disabled selectively using the TrackLastPatronActivityTriggers system preference using the [ ] Patron authentication via API option.. To test: 1. Create a new user, ensuring to set the Username and password fields. *Import to do this first* 2. Edit the TrackLastPatronActivityTriggers syspref and check all options. 3. Ensure the RESTBasicAuth syspref is set to Enable. 4. Check the lastseen date of your new user using a SQL report SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid = 'USERNAME' (Replace USERNAME with your chosen username for the new patron) NOTE: **Ensure the cache expiry of the SQL report is set to 0** 5. The lastseen for your new user should be null 6. 'restart_all' Koha services to clear plack cache. 7. Run the attached api_verify_lastseen.pl test script **Change P_USERNAME and P_PASSWORD to the username and password of your new user. (script contains expected output for successful verification) 8. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should still be null. 9. Apply Patch 10. 'restart_all' Koha services 11. Edit the TrackLastPatronActivityTriggers syspref and check the '[ ] Patron authentication via API' option 12. Rerun the api_verify_lastseen.pl 13. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should now be updated to the time of the last script run. For good measure: 14. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** the '[ ] Patron authentication via API' option 15. 'restart_all' Koha services to clear plack cache. 16. Rerun the api_verify_lastseen.pl 17. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should have remained the same as previous. Sponsored-by: Westlake Porter Public Library <https://westlakelibrary.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 CJ Lynce <cj.lynce@westlakelibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This patch add the option release notes| |in the | |'TrackLastPatronActivityTri | |ggers' system preference to | |update a patron's | |'Lastseen' entry when that | |patron's username and | |password are successfully | |validated via the REST | |API's | |/auth/password/validation | |endpoint. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact| |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 --- Comment #6 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Looking here :-D -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Bernard <bernard.scaife@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #185582|0 |1 is obsolete| | --- Comment #7 from Bernard <bernard.scaife@openfifth.co.uk> --- Created attachment 185906 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=185906&action=edit Bug 36536: Make REST APIs validateUserAndPassword update borrowers.lastseen This patch added the option to update borrowers.lastseen when a patron username and password is verified via the REST API. This can be enabled or disabled selectively using the TrackLastPatronActivityTriggers system preference using the [ ] Patron authentication via API option.. To test: 1. Create a new user, ensuring to set the Username and password fields. *Import to do this first* 2. Edit the TrackLastPatronActivityTriggers syspref and check all options. 3. Ensure the RESTBasicAuth syspref is set to Enable. 4. Check the lastseen date of your new user using a SQL report SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid = 'USERNAME' (Replace USERNAME with your chosen username for the new patron) NOTE: **Ensure the cache expiry of the SQL report is set to 0** 5. The lastseen for your new user should be null 6. 'restart_all' Koha services to clear plack cache. 7. Run the attached api_verify_lastseen.pl test script **Change P_USERNAME and P_PASSWORD to the username and password of your new user. (script contains expected output for successful verification) 8. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should still be null. 9. Apply Patch 10. 'restart_all' Koha services 11. Edit the TrackLastPatronActivityTriggers syspref and check the '[ ] Patron authentication via API' option 12. Rerun the api_verify_lastseen.pl 13. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should now be updated to the time of the last script run. For good measure: 14. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** the '[ ] Patron authentication via API' option 15. 'restart_all' Koha services to clear plack cache. 16. Rerun the api_verify_lastseen.pl 17. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should have remained the same as previous. Sponsored-by: Westlake Porter Public Library <https://westlakelibrary.org> Signed-off-by: Bernard Scaife <bernard.scaife@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #185906|0 |1 is obsolete| | --- Comment #8 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 185917 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=185917&action=edit Bug 36536: Unit tests This patch introduces tests for the feature enabling patron's `lastseen` attribute be updated when a successful password validation happens through the API. To test: 1. Apply this patch 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/password_validation.t => FAIL: Tests fail! The feature is not implemented! Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 --- Comment #9 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 185918 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=185918&action=edit Bug 36536: Make REST APIs validateUserAndPassword update borrowers.lastseen This patch added the option to update borrowers.lastseen when a patron username and password is verified via the REST API. This can be enabled or disabled selectively using the TrackLastPatronActivityTriggers system preference using the [ ] Patron authentication via API option.. To test: 1. Create a new user, ensuring to set the Username and password fields. *Import to do this first* 2. Edit the TrackLastPatronActivityTriggers syspref and check all options. 3. Ensure the RESTBasicAuth syspref is set to Enable. 4. Check the lastseen date of your new user using a SQL report SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid = 'USERNAME' (Replace USERNAME with your chosen username for the new patron) NOTE: **Ensure the cache expiry of the SQL report is set to 0** 5. The lastseen for your new user should be null 6. 'restart_all' Koha services to clear plack cache. 7. Run the attached api_verify_lastseen.pl test script **Change P_USERNAME and P_PASSWORD to the username and password of your new user. (script contains expected output for successful verification) 8. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should still be null. 9. Apply Patch 10. 'restart_all' Koha services 11. Edit the TrackLastPatronActivityTriggers syspref and check the '[ ] Patron authentication via API' option 12. Rerun the api_verify_lastseen.pl 13. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should now be updated to the time of the last script run. For good measure: 14. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** the '[ ] Patron authentication via API' option 15. 'restart_all' Koha services to clear plack cache. 16. Rerun the api_verify_lastseen.pl 17. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should have remained the same as previous. Sponsored-by: Westlake Porter Public Library <https://westlakelibrary.org> Signed-off-by: Bernard Scaife <bernard.scaife@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #185917|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #185918|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 --- Comment #10 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 185919 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=185919&action=edit Bug 36536: Unit tests This patch introduces tests for the feature enabling patron's `lastseen` attribute be updated when a successful password validation happens through the API. To test: 1. Apply this patch 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/password_validation.t => FAIL: Tests fail! The feature is not implemented! Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 --- Comment #11 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 185920 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=185920&action=edit Bug 36536: Make REST APIs validateUserAndPassword update borrowers.lastseen This patch added the option to update borrowers.lastseen when a patron username and password is verified via the REST API. This can be enabled or disabled selectively using the TrackLastPatronActivityTriggers system preference using the [ ] Patron authentication via API option.. To test: 1. Create a new user, ensuring to set the Username and password fields. *Import to do this first* 2. Edit the TrackLastPatronActivityTriggers syspref and check all options. 3. Ensure the RESTBasicAuth syspref is set to Enable. 4. Check the lastseen date of your new user using a SQL report SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid = 'USERNAME' (Replace USERNAME with your chosen username for the new patron) NOTE: **Ensure the cache expiry of the SQL report is set to 0** 5. The lastseen for your new user should be null 6. 'restart_all' Koha services to clear plack cache. 7. Run the attached api_verify_lastseen.pl test script **Change P_USERNAME and P_PASSWORD to the username and password of your new user. (script contains expected output for successful verification) 8. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should still be null. 9. Apply Patch 10. 'restart_all' Koha services 11. Edit the TrackLastPatronActivityTriggers syspref and check the '[ ] Patron authentication via API' option 12. Rerun the api_verify_lastseen.pl 13. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should now be updated to the time of the last script run. For good measure: 14. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** the '[ ] Patron authentication via API' option 15. 'restart_all' Koha services to clear plack cache. 16. Rerun the api_verify_lastseen.pl 17. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should have remained the same as previous. Sponsored-by: Westlake Porter Public Library <https://westlakelibrary.org> Signed-off-by: Bernard Scaife <bernard.scaife@openfifth.co.uk> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off --- Comment #12 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Hi! Thanks for submitting this! I decided to write some tests for this so no one breaks the feature in future code changes. Nice job! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |25.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 --- Comment #13 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 25.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.11.00 |25.11.00,25.05.04 released in| | Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 --- Comment #14 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Nice work everyone! Pushed to 25.05.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |fridolin.somers@biblibre.co | |m --- Comment #15 from Fridolin Somers <fridolin.somers@biblibre.com> --- More like en enhancement, I dont backport to 24.11.x -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org