[Bug 21198] New: authenticate_api_request should stash the reason access is granted

classic Classic list List threaded Threaded
9 messages Options
Reply | Threaded
Open this post in threaded view
|

[Bug 21198] New: authenticate_api_request should stash the reason access is granted

bugzilla-daemon
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21198

            Bug ID: 21198
           Summary: authenticate_api_request should stash the reason
                    access is granted
 Change sponsored?: ---
           Product: Koha
           Version: master
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5 - low
         Component: REST api
          Assignee: [hidden email]
          Reporter: [hidden email]

There's a pattern we will be facing in the controllers where overloading the
behaviour depending on the logged user permissions. We have the information on
the request on the permissions check step, and it should be carried down to the
controllers for its use.

--
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list
[hidden email]
http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
Reply | Threaded
Open this post in threaded view
|

[Bug 21198] authenticate_api_request should stash the reason access is granted

bugzilla-daemon
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21198

Alex Arnaud <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[hidden email]

--
You are receiving this mail because:
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list
[hidden email]
http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
Reply | Threaded
Open this post in threaded view
|

[Bug 21198] authenticate_api_request should stash the reason access is granted

bugzilla-daemon
In reply to this post by bugzilla-daemon
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21198

Tomás Cohen Arazi <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends on|                            |22071


Referenced Bugs:

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22071
[Bug 22071] Make authenticate_api_request stash koha.user in OAuth use case
--
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.
_______________________________________________
Koha-bugs mailing list
[hidden email]
http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
Reply | Threaded
Open this post in threaded view
|

[Bug 21198] authenticate_api_request should stash the reason access is granted

bugzilla-daemon
In reply to this post by bugzilla-daemon
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21198

Tomás Cohen Arazi <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[hidden email],
                   |                            |[hidden email],
                   |                            |martin.renvoize@ptfs-europe
                   |                            |.com

--
You are receiving this mail because:
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list
[hidden email]
http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
Reply | Threaded
Open this post in threaded view
|

[Bug 21198] authenticate_api_request should stash the reason access is granted

bugzilla-daemon
In reply to this post by bugzilla-daemon
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21198

Tomás Cohen Arazi <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|[hidden email]-commun |[hidden email]
                   |ity.org                     |

--
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.
_______________________________________________
Koha-bugs mailing list
[hidden email]
http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
Reply | Threaded
Open this post in threaded view
|

[Bug 21198] authenticate_api_request should stash the reason access is granted

bugzilla-daemon
In reply to this post by bugzilla-daemon
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21198

--- Comment #1 from Tomás Cohen Arazi <[hidden email]> ---
Created attachment 83683
  -->
https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=83683&action=edit
Bug 21198: Unit tests

--
You are receiving this mail because:
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list
[hidden email]
http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
Reply | Threaded
Open this post in threaded view
|

[Bug 21198] authenticate_api_request should stash the reason access is granted

bugzilla-daemon
In reply to this post by bugzilla-daemon
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21198

--- Comment #2 from Tomás Cohen Arazi <[hidden email]> ---
Created attachment 83684
  -->
https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=83684&action=edit
Bug 21198: Make authenticate_api_request stash the reason access is granted

This patch makes the authenticate_api_request method stash the reason
the request or has been granted access to the resource.

Possible values are:
- permissions
- owner
- guarantor

This will allow the controllers to avoid querying on their own for this
info.

To test:
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/auth_authenticate_api_request.t
=> SUCCESS: Tests pass!
- Sign off :-D

--
You are receiving this mail because:
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list
[hidden email]
http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
Reply | Threaded
Open this post in threaded view
|

[Bug 21198] authenticate_api_request should stash the reason access is granted

bugzilla-daemon
In reply to this post by bugzilla-daemon
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21198

Tomás Cohen Arazi <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |Needs Signoff

--- Comment #3 from Tomás Cohen Arazi <[hidden email]> ---
When I thought about this, I was writing the /patrons/:patron_id/password
endpoint, which was an hybrid endpoint: it was intended for the user to change
its own password, and also an admin user to change a patron's password. It
required the controller to check what was the reason to grant access to the
resource.

We decided to create a /public namespace for endpoints that would be used by
unprivileged users instead.

I decided to still submit this, because
- We might need it
- People writing endpoints through plugins could take advantage of this

I hope you'll agree with this enhancement.

--
You are receiving this mail because:
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list
[hidden email]
http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
Reply | Threaded
Open this post in threaded view
|

[Bug 21198] authenticate_api_request should stash the reason access is granted

bugzilla-daemon
In reply to this post by bugzilla-daemon
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21198
Bug 21198 depends on bug 22071, which changed state.

Bug 22071 Summary: authenticate_api_request does not stash koha.user in the OAuth use case
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22071

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|Pushed to Stable            |RESOLVED
         Resolution|---                         |FIXED

--
You are receiving this mail because:
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list
[hidden email]
http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/