This patch adjusts the logic to consider all permissions and not just the top level flags
Test plan:
1) Create or edit a user to have all acquisitions permissions except one (not relevant which one, any will do)
2) Log into the staff interface and go to acquisitions > vendors and click the vendor in the table
3) The left menu will be missing everything except invoices
4) Apply patch and restart_all
5) Refresh the page, the menu should now be populated
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
We should not call discard_changes after accessing ->id but before
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To reproduce
1- Enable the ERMModule system preference
1- Go to Administration > System Preferences
2- Search for ERMModule
3- Change the value to "Enable"
4- Click on "Save all e-resource management preferences"
5- Return to the main screen
1- Create an agreement
1- Go to e-resource management
2- Click on "Agreements"
3- Click on "New agreement"
4- Fill out the form (mandatory fields)
- Agreement name: Natural Medicines
- Status: Active
5- Click on "Submit"
2- Edit the agreement
1- Click on "Agreements"
2- Click on "Edit" to the right of the Natural Medicines agreement
3- Click on "Submit"
--> Something went wrong: SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data
We got the same error when editing a license, a package or a title
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch renames the entire API structure from SFTP-specific to generic
file transport terminology to reflect the polymorphic nature of the system.
API Changes:
- Endpoints: /config/sftp_servers -> /config/file_transports
- Parameters: sftp_server_id -> file_transport_id
- Definitions: sftp_server -> file_transport
- Controller: Config::SFTP::Servers -> Config::File::Transports
File Changes:
- api/v1/swagger/definitions/sftp_server.yaml -> file_transport.yaml
- api/v1/swagger/paths/config_sftp_servers.yaml -> config_file_transports.yaml
- Koha/REST/V1/Config/SFTP/Servers.pm -> Koha/REST/V1/Config/File/Transports.pm
- t/db_dependent/api/v1/sftp_servers.t -> file_transports.t
Updated References:
- swagger.yaml: paths, definitions, parameters, tags
- Template JavaScript: API URLs and variable names
- Controller: package name, variable names, error messages
- Tests: endpoints, parameters, descriptions
- API mapping: to_api_mapping field name correction
To test:
1. Apply this patch
2. Run: yarn api:bundle (to regenerate swagger bundle)
3. Run: prove t/db_dependent/api/v1/file_transports.t
4. All API tests should pass
5. Verify admin interface uses new API endpoints
6. Test CRUD operations work correctly
The API now consistently uses 'file_transports' terminology matching
the polymorphic file transport system that supports FTP, SFTP, and
future transport types.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
As the title says, use the new polymorphic classes in the API
controllers
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds a central FTP/SFTP management UI, with an associated
database object and class, plus the beginnings of an API. We can use
this code as a building block for adding FTP/SFTP connections to
other parts of the system, as well as to improve the usability of the
EDI transports. It is also now possible to test these connections
from within the Koha UI.
To test:-
You will need access to an FTP or SFTP server
Contact me if you need a disposable FTP/SFTP server
a) Go to Koha Administration
b) Notice no FTP/SFTP referenced on this page
c) APPLY PATCH, reset_all
d) Create new user, let's say sftpuser
e) Set permissions for new user to include:
1) catalogue
2) parameters -> manage_sftp_servers
f) Log in with this new user, go back to Koha Administration
1) Notice the FTP/SFTP servers option
g) Undo step e2) for the sftpuser via the koha admin user
1) Refresh the Koha Administration page as the sftpuser
2) Notice how FTP/SFTP servers has disappeared
h) Back to koha admin, go to Koha Administration -> FTP/SFTP Servers -> New
i) Complete form depending on the FTP or SFTP server you have access to, Submit
1) Notice you are prompted to confirm before saving
j) Select Edit, observe your details are the same, and Submit again
k) Repeat step J one additional time
l) Select Test, observe all tests passing
m) Select Delete, confirm deletion, and observe server disappear
n) Optionally, run prove on new tests
1) t/Koha/Auth/Permissions.t
2) t/db_dependent/Koha/SFTP/Server.t
3) t/db_dependent/api/v1/sftp_servers.t
o) SIGN-OFF
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch moves logic out of the background job file and into the Koha::ERM::EHoldings::Title class where it should belong. Methods are also renamed to differentiate between object methods and helper methods
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Eric Phetteplace <phette23@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
An alternative approach to the original submission for bug 9762. Instead
of recording a distinct action log line for a set of override messages
in addition to the standard issue record, this patch updates the
existing issue log to include any confirmation or impossible responses
from the preceeding CanBookBeIssued call.
We continue to record these as a JSON structure as the prior patch did,
but instead of human messages we use the predefined codes as returned
from the existing CanBookBeIssued response.
To test:
After each step, a single action log message should be displayed under
`Tools > Log viewer`. The message itself will now consist of a JSON
string with an array of 'confirmations' and 'forced' strings
representing the overriden feedback from CanBookBeIssued.
Circulation -- Checking out
1) Check out an item that is age-restricted (AgeRestrictionOverride syspref)
2) Check out an item that has a “not for loan” status (AllowNotForLoanOverride
syspref)
3) Check out an item that has a “lost” status (IssueLostItem syspref)
4) Check out an item to a patron who has reached the checkout limit
(AllowTooManyOverride syspref)
5) Check out an item to a patron who is not allowed to borrow this item type
6) Check out an item to a patron who has unpaid fines (AllFinesNeedOverride
and/or AllowFineOverride + noissuescharge sysprefs)
7) Check out an item on hold for someone else
8) Check out an item on hold ready for pickup by someone else
9) Check out an item already checked out to someone else
(AutoReturnCheckedOutItems syspref)
10) Check out to a patron who has restrictions
Circulation -- Checking in
11) Ignore a hold upon check in
12) Ignore a hold and transfer upon check in
Circulation – Renewing
13) Renew an item on hold for someone else
(AllowRenewalOnHoldOverride syspref)
14) Renew an item that has reached the maximum number of renewals
(AllowRenewalLimitOverride syspref)
Holds
15) Place a hold for a patron who is not allowed to place this item
type on hold (AllowHoldPolicyOverride syspref)
16) Place a hold for a patron who has reached the maximum number of
holds
17) Place an item-level hold when rules dictate that this is not
allowed
Sponsored-by: OpenFifth <https://openfifth.co.uk/>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch added the option to update borrowers.lastseen when a patron username
and password is verified via the REST API. This can be enabled or disabled
selectively using the TrackLastPatronActivityTriggers system preference
using the [ ] Patron authentication via API option..
To test:
1. Create a new user, ensuring to set the Username and password fields.
*Import to do this first*
2. Edit the TrackLastPatronActivityTriggers syspref and check all options.
3. Ensure the RESTBasicAuth syspref is set to Enable.
4. Check the lastseen date of your new user using a SQL report
SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid = 'USERNAME'
(Replace USERNAME with your chosen username for the new patron)
NOTE: **Ensure the cache expiry of the SQL report is set to 0**
5. The lastseen for your new user should be null
6. 'restart_all' Koha services to clear plack cache.
7. Run the attached api_verify_lastseen.pl test script
**Change P_USERNAME and P_PASSWORD to the username and password of your new user.
(script contains expected output for successful verification)
8. Re-check the lastseen date of your new user again via SQL (step 4)
The lastseen should still be null.
9. Apply Patch
10. 'restart_all' Koha services
11. Edit the TrackLastPatronActivityTriggers syspref and check the '[ ] Patron authentication via API' option
12. Rerun the api_verify_lastseen.pl
13. Re-check the lastseen date of your new user again via SQL (step 4)
The lastseen should now be updated to the time of the last script run.
For good measure:
14. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** the '[ ] Patron authentication via API' option
15. 'restart_all' Koha services to clear plack cache.
16. Rerun the api_verify_lastseen.pl
17. Re-check the lastseen date of your new user again via SQL (step 4)
The lastseen should have remained the same as previous.
Sponsored-by: Westlake Porter Public Library <https://westlakelibrary.org>
Signed-off-by: Bernard Scaife <bernard.scaife@openfifth.co.uk>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
We shouldn't use the ->validation method anymore as it isn't stable. We need to pass the params into the method accounting for any param changes made
Test plan:
1) Apply the regression test patch and run the test
2) Test should fail
3) Apply this patch
4) Run test again
5) Test should pass
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch removes the reliance on `$c->validation->output` for the
query-in-body feature. This will allow bug 40417 to move forward.
It also fixes some wrong design decisions we made 5-6 years ago. This
was discussed with the Mojolicious::Plugin::OpenAPI maintainer and the
agreement was `$c->validation->output` was not stable nor intended to be
accessed like we do.
To test:
1. Run:
$ ktd --shell
k$ prove t/Koha/REST/Plugin/Query.t \
t/db_dependent/api/v1/*.t \
t/db_dependent/Koha/REST/Plugin/*
=> SUCCESS: Tests pass!
2. Apply this patchset
3. Repeat 1
=> SUCCESS: Tests pass!
4. Sign off :-D
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
I wanted to isolate the changes for the query-in-body handling and it
made sense to refactor this dupicated code at the same time. So I add
this patch for tidying the area in preparation for the other part.
Duplicated code gets simplified.
To test:
1. Apply the unit tests patch
2. Run:
$ ktd --shell
k$ prove t/Koha/REST/Plugin/Query.t \
t/db_dependent/api/v1/*.t \
t/db_dependent/Koha/REST/Plugin/
=> SUCCESS: Tests pass!
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch aligns handling of the header with how other headers are
managed.
* A helper is added which reads the header and stashes the value
* The helper is called in the same place similar helpers are called
(authenticate_api_request)
* The `objects.search_rs` helper is adjusted to use the stashed value
instead of picking it from the reserved params.
To test:
1. Apply this patches
2. Run:
$ ktd --shell
k$ prove t/Koha/REST/Plugin/Query.t \
t/db_dependent/api/v1/*.t \
t/db_dependent/Koha/REST/Plugin/*
=> SUCCESS: Tests pass! No behavior change!
3. Sign off :-D
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch fixes a subtle (yet naive) error making the controller not
care about blocking conditions if they were more than one and the first
one was overridden.
To test:
1. Apply the regression tests
2. Run:
$ ktd --shell
k$ prove t/db_dependent/api/v1/holds.t
=> FAIL: Tests fail! Some tests expect a 409 (denied for a conflict) but
return a 201!
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds new behaviors to the `POST /holds` endpoint.
It uses the framework we created in the past for overriding policy
rules, and add new options:
* expired
* debt_limit
* bad_address
* card_lost
* restricted
* hold_limit
Some status codes are changed from 403 to 409. This should be revisited
accross the codebase, as I think we made a wrong choice. Happy to review
in this bug.
The feature makes use of the newly introduced
`$patron->can_place_holds()` method, which accepts to be passed through
the overrides.
To test:
1. Apply this patches
2. Run:
$ ktd --shell
k$ yarn api:bundle
k$ koha-plack --restart kohadev
k$ prove t/db_dependent/api/v1/holds.t
=> SUCCESS: Tests pass!
3. Test the endpoint with the various scenarios using your favourite
REST tool (Postman!)
4. Sign off :-D
Signed-off-by: Kristi Krueger <kkrueger@cuyahogalibrary.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Amended-by: Jonathan Druart
typo: subsicriptions => subscriptions
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit cae75569e6e8f2bfe5a2e6d3acc111485f81cc1e)
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
It was wrong, we need to use scalar on the array, not the arrayref
(otherwise it will always be true)
No change in behaviour expected here, just some code cleaning
(cherry picked from commit 7abbcb7ba73da13d988202aaf06ba239e21692da)
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch addresses
- Translation issues in VendorList
- Removing the pagers from the contracts table
- Removing redundant code from the vendors template file
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch handles the embedded data that might also need updating when editing a vendor
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch splits the controller in two:
* A controller for staff users use
* An unprivileged access controller
A new endpoint is added for publi access:
* `/public/patrons/:patron_id/ill/requests`
The public one makes use of the state-of-the-art in Koha for public
endpoints, using the `$c->auth->public` validation helper and leaving
the (newly added) public path spec with no special permissions
requirements.
The staff-oriented endpoint gets the right permissions added (at least
those used in the main `/ill/requests` endpoint.
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ yarn api:bundle
k$ prove t/db_dependent/api/v1/ill_requests.t
=> SUCCESS: Tests pass!
3. Sign off :-D
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Tadeusz „tadzik” Sośnierz <tadeusz@sosnierz.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Sponsored-by: Wiko <https://www.wiko-berlin.de/>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Sponsored-by: Wiko <https://www.wiko-berlin.de/>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This brings it technologically closer to intranet's ILL table and also enables pagination.
Test plan:
1. In KTD, go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=master+switch and enable the ILL module
2. Run the following in koha-shell to populate the request list for user `koha`:
perl -Mt::lib::TestBuilder -e '
my $builder = t::lib::TestBuilder->new;
do {
$builder->build_sample_ill_request({borrowernumber => 51});
} for (1..50);
'
3. Navigate to http://localhost:8080/cgi-bin/koha/opac-illrequests.pl, log in as `koha` as needed
4. Observe the new request list being paginated and server-side-sortable
Sponsored-by: Wiko <https://www.wiko-berlin.de/>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Added head2 right before sub with missing POD
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Koha::REST::V1::Auth checks the request URL path and do various things
depending on how it looks.
For instance, it allows everyone to access paths starting with
"/api/v1/oauth/"
But because of how Koha::REST::V1 was written, when using mojolicious
applications Koha::App::Intranet and Koha::App::Opac, paths had to add a
path prefix ("/api"), which means the final path as seen by
Koha::REST::V1::Auth looked like this: "/api/api/v1/oauth".
I said "had to", but actually there is another way that does not require
this path manipulation and that's what this patch does:
Koha::REST::V1 now accepts a configuration parameter that allows to
change the base path for API routes, which allows
Koha::App::Plugin::RESTV1 (used by Koha::App::Intranet and
Koha::App::Opac) to generate the right routes.
This configuration parameter defaults to "/api/v1", so when outside of
Koha::App::Intranet and Koha::App::Opac (when using
debian/templates/plack.psgi for instance), the behavior is unchanged.
Test plan:
1. Do not apply the patch yet
2. Run `bin/intranet daemon -l http://*:8080`
3. Run `curl -i -d{} http://127.0.0.1:8080/api/v1/oauth/token`
It should return a 403 error, with an error message "Authentication
failure".
4. Stop `bin/intranet daemon -l http://*:8080` by hitting Ctrl-C on the
terminal you started it
5. Apply the patch
6. Run `bin/intranet daemon -l http://*:8080` again
7. Run `curl -i -d{} http://127.0.0.1:8080/api/v1/oauth/token`
This time it should return a 400 error with an error message saying
the "grant_type" property is missing.
This error is normal as we did not send any data in the POST request
body, and seeing this means Koha allowed us to use that route because
it recognized '/api/v1/oauth/' at the start of the URL path
8. You can do the same test with `bin/opac`
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Works as advertised. See Bugzilla for notes from testing.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Matt Blenkinsop
Jonathan Druart
Hammat Wele
Tomás Cohen Arazi
Martin Renvoize
Jake Deery
Matt Blenkinsop
Pedro Amorim
Martin Renvoize
CJ Lynce
Pedro Amorim
Tadeusz „tadzik” Sośnierz
Julian Maurice