https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |tomascohen@gmail.com |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 --- Comment #2 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74179 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74179&action=edit Bug 20568: API keys management in interface This introduces the concept of API keys for use in the new REST API. A key is a string of 32 alphanumerical characters (32 is purely arbitrary, it can be changed easily). A user can have multiple keys (unlimited at the moment) Keys can be generated automatically, and then we have the possibility to delete or revoke each one individually. Test plan: 1/ Go to staff interface 2/ Go to a borrower page 3/ In toolbar, click on More -> Manage API keys 4/ Click on "Generate new key" multiple times, check that they are correctly displayed under the button, and they are active by default 5/ Revoke some keys, check that they are not active anymore 6/ Delete some keys, check that they disappear from table 7/ Go to opac interface, log in 8/ In your user account pages, you now have a new tab to the left "your API keys". Click on it. 9/ Repeat steps 4-6 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED --- Comment #4 from Tomás Cohen Arazi <tomascohen@gmail.com> --- I've attached my WIP stuff just in case anyone wants to comment on that. I basically resurrected one patch from Julian from bug 13920 (API keys management in interface) and worked on adapting it to current practices. The staff interface api management page is fully functional. OPAC is next. Unit tests almost ready, not submitted. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74179|0 |1 is obsolete| | --- Comment #5 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74229 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74229&action=edit Bug 20568: API keys management in interface This introduces the concept of API keys for use in the new REST API. A key is a string of 32 alphanumerical characters (32 is purely arbitrary, it can be changed easily). A user can have multiple keys (unlimited at the moment) Keys can be generated automatically, and then we have the possibility to delete or revoke each one individually. Test plan: 1/ Go to staff interface 2/ Go to a borrower page 3/ In toolbar, click on More -> Manage API keys 4/ Click on "Generate new key" multiple times, check that they are correctly displayed under the button, and they are active by default 5/ Revoke some keys, check that they are not active anymore 6/ Delete some keys, check that they disappear from table 7/ Go to opac interface, log in 8/ In your user account pages, you now have a new tab to the left "your API keys". Click on it. 9/ Repeat steps 4-6 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 --- Comment #7 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74231 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74231&action=edit Bug 20568: Unit tests This patch adds unit tests for the introduced classes: Koha::ApiKey(s). To test: - Apply this patch - Run $ kshell k$ prove t/db_dependent/Koha/ApiKeys.t => FAIL: Tests fail because the feature is not implemented. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74229|0 |1 is obsolete| | --- Comment #9 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74233 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74233&action=edit Bug 20568: API keys management in interface This introduces the concept of API keys for use in the new REST API. A key is a string of 32 alphanumerical characters (32 is purely arbitrary, it can be changed easily). A user can have multiple keys (unlimited at the moment) Keys can be generated automatically, and then we have the possibility to delete or revoke each one individually. Test plan: 1/ Go to staff interface 2/ Go to a borrower page 3/ In toolbar, click on More -> Manage API keys 4/ Click on "Generate new key" multiple times, check that they are correctly displayed under the button, and they are active by default 5/ Revoke some keys, check that they are not active anymore 6/ Delete some keys, check that they disappear from table 7/ Go to opac interface, log in 8/ In your user account pages, you now have a new tab to the left "your API keys". Click on it. 9/ Repeat steps 4-6 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74231|0 |1 is obsolete| | --- Comment #11 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74235 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74235&action=edit Bug 20568: Unit tests This patch adds unit tests for the introduced classes: Koha::ApiKey(s). To test: - Apply this patch - Run $ kshell k$ prove t/db_dependent/Koha/ApiKeys.t => FAIL: Tests fail because the feature is not implemented. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 --- Comment #13 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 74248 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74248&action=edit Bug 20568 (follow-up) Interface and markup changes This patch makes some interface changes to bring things better in line with existing interface patterns. This patch also re-indents the modified templates with 4 spaces instead of 2 and makes <input>s self-closing. Also changed: Corrected system preference check in opac-apikeys.pl. To test, apply the patch and: In the staff client: - Open a patron record and choose More -> Manage API keys. - There should be a standard message dialog containing a link to "Generate a new key." - Clicking the link should show the form for adding a new key. - Test that clicking the "Cancel" link hides the form. - Test that creating the new key works correctly. - You should now see a table showing existing keys and a "Generate a new key" button above it. - Test that the "Delete" button asks for confirmation, and that confirming and denying both work correctly. - Test that "Revoke" and "Activate" actions still work correctly. In the OPAC: - Set the AllowPatronsManageAPIKeysInOPAC system preference to "Allow." - Log in to the OPAC and click the "your API keys" link in the sidebar. - Clicking the "Generate new key" button should display the form for adding a new key. - Clicking the "cancel" link should hide the form. - Submitting the form should add a new key. - You should now see a table showing existing keys. - Test that the "Delete" link asks for confirmation, and that confirming and denying both work correctly. - Test that "Revoke" and "Activate" actions still work correctly. - Set the AllowPatronsManageAPIKeysInOPAC system preference to "Don't allow." - Log in to the OPAC and confirm that the "your API keys" link in the sidebar is no longer visible. - Confirm that navigating directly to /cgi-bin/koha/opac-apikeys.pl results in a 404 error. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74234|0 |1 is obsolete| | --- Comment #15 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74255 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74255&action=edit Bug 20568: Add mandatory description field for api keys This patch changes the table structure adding fields usually found on this kind of api management pages. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74236|0 |1 is obsolete| | --- Comment #17 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74257 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74257&action=edit Bug 20568: API key management for OPAC users This patch makes the OPAC interface for API keys management work with the new lib. Verify all actions work for a logged user. Users without login should be redirected to an error page. The AllowPatronsManageAPIKeysInOPAC syspref is added to control if the OPAC feature is enabled or not. To test: - Verify the syspref works - Verify users can manage their API keys -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 --- Comment #19 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74259 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74259&action=edit Bug 20568: Move value => client_id + secret This patch addresses the request from Julian that api keys are expected to be client id/secret pairs. It does so by - Adding 'client_id' and 'secret' columns - Removing 'value' Tests got adjusted and so controller scripts and templates. Both libs and tests changes have been squashed. This ones remain in order to keep Owen's attribution on the template changes and avoid rebase conflicts. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74254|0 |1 is obsolete| | Attachment #74255|0 |1 is obsolete| | Attachment #74256|0 |1 is obsolete| | Attachment #74257|0 |1 is obsolete| | Attachment #74258|0 |1 is obsolete| | Attachment #74259|0 |1 is obsolete| | --- Comment #20 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 74343 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74343&action=edit Bug 20568: API keys management in interface This introduces the concept of API keys for use in the new REST API. A key is a string of 32 alphanumerical characters (32 is purely arbitrary, it can be changed easily). A user can have multiple keys (unlimited at the moment) Keys can be generated automatically, and then we have the possibility to delete or revoke each one individually. Test plan: 1/ Go to staff interface 2/ Go to a borrower page 3/ In toolbar, click on More -> Manage API keys 4/ Click on "Generate new key" multiple times, check that they are correctly displayed under the button, and they are active by default 5/ Revoke some keys, check that they are not active anymore 6/ Delete some keys, check that they disappear from table 7/ Go to opac interface, log in 8/ In your user account pages, you now have a new tab to the left "your API keys". Click on it. 9/ Repeat steps 4-6 Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 --- Comment #22 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 74345 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74345&action=edit Bug 20568: Unit tests This patch adds unit tests for the introduced classes: Koha::ApiKey(s). To test: - Apply this patch - Run $ kshell k$ prove t/db_dependent/Koha/ApiKeys.t => FAIL: Tests fail because the feature is not implemented. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 --- Comment #24 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 74347 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74347&action=edit Bug 20568 (follow-up) Interface and markup changes This patch makes some interface changes to bring things better in line with existing interface patterns. This patch also re-indents the modified templates with 4 spaces instead of 2 and makes <input>s self-closing. Also changed: Corrected system preference check in opac-apikeys.pl. To test, apply the patch and: In the staff client: - Open a patron record and choose More -> Manage API keys. - There should be a standard message dialog containing a link to "Generate a new key." - Clicking the link should show the form for adding a new key. - Test that clicking the "Cancel" link hides the form. - Test that creating the new key works correctly. - You should now see a table showing existing keys and a "Generate a new key" button above it. - Test that the "Delete" button asks for confirmation, and that confirming and denying both work correctly. - Test that "Revoke" and "Activate" actions still work correctly. In the OPAC: - Set the AllowPatronsManageAPIKeysInOPAC system preference to "Allow." - Log in to the OPAC and click the "your API keys" link in the sidebar. - Clicking the "Generate new key" button should display the form for adding a new key. - Clicking the "cancel" link should hide the form. - Submitting the form should add a new key. - You should now see a table showing existing keys. - Test that the "Delete" link asks for confirmation, and that confirming and denying both work correctly. - Test that "Revoke" and "Activate" actions still work correctly. - Set the AllowPatronsManageAPIKeysInOPAC system preference to "Don't allow." - Log in to the OPAC and confirm that the "your API keys" link in the sidebar is no longer visible. - Confirm that navigating directly to /cgi-bin/koha/opac-apikeys.pl results in a 404 error. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74347|0 |1 is obsolete| | --- Comment #26 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74388 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74388&action=edit Bug 20568: (follow-up) Interface and markup changes This patch makes some interface changes to bring things better in line with existing interface patterns. This patch also re-indents the modified templates with 4 spaces instead of 2 and makes <input>s self-closing. Also changed: Corrected system preference check in opac-apikeys.pl. To test, apply the patch and: In the staff client: - Open a patron record and choose More -> Manage API keys. - There should be a standard message dialog containing a link to "Generate a new key." - Clicking the link should show the form for adding a new key. - Test that clicking the "Cancel" link hides the form. - Test that creating the new key works correctly. - You should now see a table showing existing keys and a "Generate a new key" button above it. - Test that the "Delete" button asks for confirmation, and that confirming and denying both work correctly. - Test that "Revoke" and "Activate" actions still work correctly. In the OPAC: - Set the AllowPatronsManageAPIKeysInOPAC system preference to "Allow." - Log in to the OPAC and click the "your API keys" link in the sidebar. - Clicking the "Generate new key" button should display the form for adding a new key. - Clicking the "cancel" link should hide the form. - Submitting the form should add a new key. - You should now see a table showing existing keys. - Test that the "Delete" link asks for confirmation, and that confirming and denying both work correctly. - Test that "Revoke" and "Activate" actions still work correctly. - Set the AllowPatronsManageAPIKeysInOPAC system preference to "Don't allow." - Log in to the OPAC and confirm that the "your API keys" link in the sidebar is no longer visible. - Confirm that navigating directly to /cgi-bin/koha/opac-apikeys.pl results in a 404 error. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 --- Comment #28 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74434 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74434&action=edit Bug 20568: (follow-up) Atomic update fix Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74434|0 |1 is obsolete| | --- Comment #29 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 74454 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74454&action=edit Bug 20568: (follow-up) Atomic update fix Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |20612 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20612 [Bug 20612] Make OAuth2 use patron's client_id/secret pairs -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 --- Comment #32 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74477 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74477&action=edit Bug 20568: (QA follow-up) Make sure client_id and secret are not overwritten on store Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74478|0 |1 is obsolete| | --- Comment #34 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74479 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74479&action=edit Bug 20568: (QA follow-up) Get rid of the id column Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Passed QA -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |oleonard@myacpl.org --- Comment #37 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Julian Maurice from comment #30)

QA comments:

1) The UUID generation happens in the store method. This means that every time I revoke/activate a key, client_id and secret are changed. I think that is not the desired behaviour.

Done. I provided both regression tests for this situation and the fix.

2) A CSRF attack can remove and revoke keys. This can be prevented by using Koha::Token.

Done. Good catch :-D

3) UUID::generate($uuid); UUID::unparse( $uuid, $uuidstring ); can be replaced by $uuidstring = uuid();

I've had issues with Jessie's version of UUID (0.05). I get: Error: "uuid" is not exported buy the UUID module

4) In intranet, if I have no key and click twice on "Generate a new client id/secret pair" link, the form appear then disappear. Not really a problem, but it's an odd behaviour. I suggest to just show the button even if I have no keys, like in OPAC.

Right, I will think about it. Maybe Owen can answer about this.

5) I feel that api_keys.id is not useful as client_id can be used as a primary key

You are right! Removed!

6) Since we're using UUID, why not store the binary representation instead of the string representation ? I don't know how that would affect performance but that will save storage space. If we stick with the string representation I suggest that we change the data type of client_id and secret to a fixed-width string type (CHAR(36) ?)

I don't think this is necessary. For this client_id/secret pairs as are not expected be be many. Also, VARCHAR only takes as much space as the size of the content. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74343|0 |1 is obsolete| | --- Comment #39 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 74486 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74486&action=edit Bug 20568: API keys management in interface This introduces the concept of API keys for use in the new REST API. A key is a string of 32 alphanumerical characters (32 is purely arbitrary, it can be changed easily). A user can have multiple keys (unlimited at the moment) Keys can be generated automatically, and then we have the possibility to delete or revoke each one individually. Test plan: 1/ Go to staff interface 2/ Go to a borrower page 3/ In toolbar, click on More -> Manage API keys 4/ Click on "Generate new key" multiple times, check that they are correctly displayed under the button, and they are active by default 5/ Revoke some keys, check that they are not active anymore 6/ Delete some keys, check that they disappear from table 7/ Go to opac interface, log in 8/ In your user account pages, you now have a new tab to the left "your API keys". Click on it. 9/ Repeat steps 4-6 Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74345|0 |1 is obsolete| | --- Comment #41 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 74488 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74488&action=edit Bug 20568: Unit tests This patch adds unit tests for the introduced classes: Koha::ApiKey(s). To test: - Apply this patch - Run $ kshell k$ prove t/db_dependent/Koha/ApiKeys.t => FAIL: Tests fail because the feature is not implemented. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74388|0 |1 is obsolete| | --- Comment #43 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 74490 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74490&action=edit Bug 20568: (follow-up) Interface and markup changes This patch makes some interface changes to bring things better in line with existing interface patterns. This patch also re-indents the modified templates with 4 spaces instead of 2 and makes <input>s self-closing. Also changed: Corrected system preference check in opac-apikeys.pl. To test, apply the patch and: In the staff client: - Open a patron record and choose More -> Manage API keys. - There should be a standard message dialog containing a link to "Generate a new key." - Clicking the link should show the form for adding a new key. - Test that clicking the "Cancel" link hides the form. - Test that creating the new key works correctly. - You should now see a table showing existing keys and a "Generate a new key" button above it. - Test that the "Delete" button asks for confirmation, and that confirming and denying both work correctly. - Test that "Revoke" and "Activate" actions still work correctly. In the OPAC: - Set the AllowPatronsManageAPIKeysInOPAC system preference to "Allow." - Log in to the OPAC and click the "your API keys" link in the sidebar. - Clicking the "Generate new key" button should display the form for adding a new key. - Clicking the "cancel" link should hide the form. - Submitting the form should add a new key. - You should now see a table showing existing keys. - Test that the "Delete" link asks for confirmation, and that confirming and denying both work correctly. - Test that "Revoke" and "Activate" actions still work correctly. - Set the AllowPatronsManageAPIKeysInOPAC system preference to "Don't allow." - Log in to the OPAC and confirm that the "your API keys" link in the sidebar is no longer visible. - Confirm that navigating directly to /cgi-bin/koha/opac-apikeys.pl results in a 404 error. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74454|0 |1 is obsolete| | --- Comment #45 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 74492 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74492&action=edit Bug 20568: (follow-up) Atomic update fix Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74477|0 |1 is obsolete| | --- Comment #47 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 74494 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74494&action=edit Bug 20568: (QA follow-up) Make sure client_id and secret are not overwritten on store Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74482|0 |1 is obsolete| | --- Comment #49 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 74496 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74496&action=edit Bug 20568: CSRF protection Edit: fix warning introduced by this patch Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de Text to go in the|Adds the ability to handle |Adds the ability to handle release notes|patron-level API keys to be |patron-level API keys to be |used for authenticating the |used for authenticating the |REST api. |REST API. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |20627 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20627 [Bug 20627] Prevent leakages of user permissions to api access tokens -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 --- Comment #50 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74980 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74980&action=edit Bug 20568: (QA follow-up) Remove api-key management from OPAC Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 --- Comment #52 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 75023 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75023&action=edit Bug 20568: (QA follow-up) Remove unused vars Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 --- Comment #54 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 75187 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75187&action=edit Bug 20568: fix shebang -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #56 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Pushed to master for 18.05, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to Master |RESOLVED CC| |martin.renvoize@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |22071 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22071 [Bug 22071] authenticate_api_request does not stash koha.user in the OAuth use case -- You are receiving this mail because: You are watching all bug changes.