Commit Graph

597 Commits

Author SHA1 Message Date
Martin Renvoize f90715782c
Bug 33690: Convert to x-koha-override
This patch converts the existing work to use x-koha-override instead of
introducing an entirely new header and we default to the system
preference value if the override isn't passed.

I believe this is more consistent with our approach in other areas of
koha to date.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 11:07:56 -04:00
Kyle M Hall 79a5509b77
Bug 33690: Add ability to send welcome notice when creating patrons using the REST API
It would be nice to have the ability to send a welcome notice when creating patrons via the API.

Test Plan:
1) Apply this patch
2) Ensure you have a WELCOME notice
3) Create a new patron using the REST API ( api/v1/patrons )
4) Note no welcome notice is sent to the patron ( you can check the
   notices tab for the patron )
5) Repeat step 3, but send the header X-Koha-SendWelcomeEmail with a
   value of 1 as part of the POST
6) Note the welcome message for the patron is in their notices!

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Bug 33690: Tidy test

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 11:07:55 -04:00
David Cook 6a0955946e
Bug 30843: Add mfa_range configuration option for TOTP
This change adds a mfa_range configuration option for TOTP
to koha-conf.xml, and overrides the "verify" method from
Auth::GoogleAuth in order to provide a new default for "range"

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=TwoFactorAuthentication
3. Change the syspref to "Enable"
4. Go to
http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51
5. Click "More" and "Manage two-factor authentication"
6. Register using an app
7. In an Incognito window, go to
http://localhost:8081/cgi-bin/koha/mainpage.pl
8. Sign in with the "koha" user
9. Note down a code from your Authenticator app
10. Wait until after 60 seconds and try it
11. Note it says "Invalid two-factor code"
12. Try a new code from the app
13. Note that it works

14. Add <mfa_range>10</mfa_range> to /etc/koha/sites/kohadev/koha-conf.xml
15. Clear memcached and koha-plack --restart kohadev
16. Sign in with the "koha" user
17. Note down a code from your Authenticator app
18. Wait 4 minutes and then try it
19. Note that it works

20. Disable your two-factor authentication and click to re-enable it
21. Use a code older than 60 seconds when registering for the two
factor authentication
22. Note that the code works

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 10:53:51 -03:00
Jonathan Druart fa28d2a17c
Bug 32496: Some fixes
This can be squashed

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-22 10:52:40 -03:00
Arthur Suzuki 40ca7aa06c
Bug 32942: (QA follow-up) Moving Suggestion->STATUS check to Suggestion::store
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-18 15:31:45 -03:00
Kyle M Hall e0b3a6c2aa
Bug 34731: Don't call SendQueuedMessages if message_id is bad
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-12 09:44:59 -03:00
Marcel de Rooy 6f5915cf01
Bug 34339: (QA follow-up) Replace new by search in Licenses
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-08 11:54:51 -03:00
Jonathan Druart dd8b3c3da7
Bug 34339: Avoid relying on $c->validation - ERM
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-08 11:54:50 -03:00
Tomas Cohen Arazi 5788f94868
Bug 34339: (bug 33556 follow-up) Easy ERM-related changes
I left the (easy) ERM cases out because it throws this when running the
QA script:

Processing files before patches
|========================>| 51 / 51 (100.00%)

An error occurred : Inconsistent hierarchy during C3 merge of class 'Koha::REST::V1::ERM::EHoldings::Titles::Local':
	current merge results [
		Koha::REST::V1::ERM::EHoldings::Titles::Local,
	]
	merging failed on 'Mojolicious::Controller' at /kohadevbox/qa-test-tools/koha-qa.pl line 112.

and didn't want this to pollute the rest of the changes.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-08 11:54:49 -03:00
Tomas Cohen Arazi 749783debf
Bug 34313: Add patron information in pass validation response
This patch makes the password validation response return the following
patron attributes to the API consumer:

* cardnumber
* userid

This will give hints on what was used to validate in the fallback
bahvior the endpoint has.

To test:
1. Apply the unit tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/password_validation.t
=> FAIL: The endpoint doesn't return this valuable data
3. Apply this patch
4. Repeat 2
=> SUCESS: Tests pass! We got the cardnumber and the userid!
5. Sign off :-D

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-08-29 14:59:02 -03:00
Tomas Cohen Arazi a05dff84eb
Bug 34024: (QA follow-up) Allow pickup location changing for in transit holds
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-08-18 10:29:25 +03:00
Tomas Cohen Arazi a1b5bd9534
Bug 34024: Block changing pickup location for found holds
This patch adds a check on holds for 'found' statuses. Holds with the
following statuses have special workflows in Koha, and overwritting
their pickup locations yields uncertain scenarios:

* Waiting: the item has probably been put on a special shelve
* In transit: the item is travelling to a new destination, and changing
  the pickup location should include some validations, and probably
  generate some notifications. At least.
* In processing: the item has already been taken out of the shelve for
  some internal processing. Changing the pickup location could interfere
  with this workflow. Overriding this limitation could be introduced
  with care on a separate report.

To test:
1. Apply the unit tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/holds.t
=> FAIL: Tests don't pass. Holds go through (200) instead of being
rejected (409).
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-08-18 10:29:23 +03:00
Tomas Cohen Arazi eb224540e2
Bug 34365: Add cancellation request flow to DELETE /holds
This patch adds a new `x-koha-override` header to allow enforcing the
cancellation request flow for waiting holds.

If the hold is not waiting, the header has no effect.

To test:
1. Apply the tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/holds.t
=> FAIL: The endpoint doesn't implement the required logic
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass! The endpoint behavior is changed!
5. Sign off :-D

Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-08-15 11:25:54 +03:00
Martin Renvoize 3c90dbcb82
Bug 32739: (follow-up) QA Cleanup
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-25 16:25:37 -03:00
Tomas Cohen Arazi 69653a281d
Bug 32739: Allow other patron identifier on pwd validation
This patch takes a step forward on the password validation endpoint, by
adding  the `identifier` parameter and making it be allowed
to be the patron's `cardnumber` or the `userid`.

The current `userid` only validation option is kept as-is.

The implementation relies on `C4::Auth::checkpw` to query for the
patron.

To test:
1. Apply this patches
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/password_validation.t
=> SUCCESS: Tests pass!
3. Sign off :-D

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-25 16:25:37 -03:00
Tomas Cohen Arazi 95af4c9de1
Bug 33556: Avoid relying on $c->validation
Talking to the OpenAPI plugin maintainer, he mentioned the use of $c->validation->output should be avoided as the plugin is not designed to have a stable behavior there, and he even thought of just removing the method.

That method returns an internal data structure the plugin uses to validate things, and then updates the request itself.

Take the following example:

GET /patrons/123
x-koha-embed: checkouts,library

without the OpenAPI plugin, requesting the header like this:

$c->req->headers->header('x-koha-embed')

would return a scalar, the string 'checkouts,library'.

When using the plugin, and with `x-koha-embed` being defined as collectionFormat: csv, that header is entirely replaced by an arrayref.

That's how the plugin works and how it is expected to be used. So we need to replace the uses of $c->validation format, with normal Mojo usage to avoid future headaches.

This patch changes:
* $c->validation->param => $c->param
* $c->validation->param('body') => $c->req->json

To test:
1. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/*.t
=> SUCCESS: Tests pass!
2. Apply this patches
3. Repeat 1
=> SUCCESS: Tests still pass!
4. Sign off :-D

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-21 17:14:37 -03:00
Tomas Cohen Arazi dcbd3e6929
Bug 33556: Path parameters are handled explicitly in the controllers
In the case of $c->objects->search_rs, the variable is just not used.
In the case of /acq/orders, it's a leftover from when we removed in the
helper. Check there are tests with path params everywhere (including
orders) and it has no effect.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-21 17:14:36 -03:00
Tomas Cohen Arazi e8c5c0360a
Bug 33105: Avoid using $c->validation
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-20 10:59:33 -03:00
Tomas Cohen Arazi 5ba8a8510a
Bug 33105: Tidy files
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-20 10:59:31 -03:00
Jonathan Druart 3ead2ab623
Bug 33105: Add tests
Signed-off-by: Jonathan Field <jonathan.fieeld@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-20 10:59:25 -03:00
Nick Clemens 7afbba200d
Bug 33444: Update AddRenewal to take a hashref of params
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Removed skip_record_index => 1 from automatic_renewals.pl. See BZ.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-19 12:06:52 -03:00
Tomas Cohen Arazi d0ef15717f
Bug 30979: Fix regression
This patch fixes a regression introduced by the 'Fix public availability
500' follow-up.

To test:
1. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/checkouts.t
=> FAIL: Tests fail!
2. Apply this patch
3. Repeat 1
=> SUCCESS: Tests pass! Tests are useful!
4. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-14 12:14:48 -03:00
Martin Renvoize 96bbd70d2d
Bug 30979: (follow-up) Fix public availability 500
When we introduced the logged in user id to the token generation we
had the knock on effect of creating a 500 response for unauthenticated
availability lookups.

This patch resolves the 500, but results in a token that's not useful
for the end user.  We should consider this in the wider context down the
line.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-14 12:14:45 -03:00
Martin Renvoize bc55051e49
Bug 30979: Limit public checkout endpoint using preference
The public api endpoint for self-checkout should only be enabled in the
case where the OpacTrustedSelfCheckout option is enabled.

Signed-off-by: Silvia Meakins <smeakins@eso.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-14 12:14:41 -03:00
Martin Renvoize 959794e1cb
Bug 30979: Add public endpoints
This patch expands the checkouts endpoints to allow for a public workflow.

We add the availability endpoint under `/public/checkouts/availability`
and restrict the information we send back to only those fields a public
user should be allowed to see.

We also add a new checkout endpoint at `/patrons/{patron_id}/checkouts`
that allows for users to checkout to themselves and accepts the same POST
request with checkout details including item_id and a confirmation token
in the body that the staff client endpoints accept.

Signed-off-by: Silvia Meakins <smeakins@eso.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-14 12:14:39 -03:00
Tomas Cohen Arazi 927c5a8913
Bug 33817: (QA follow-up) Fix tidyness
This patch fixes some reported tidyness issues with the patches.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-10 15:43:10 -03:00
Jonathan Druart 384de4a74a
Bug 33817: Enforce server-side
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-10 15:43:09 -03:00
Tomas Cohen Arazi d90d264253
Bug 33974: (follow-up) _order_by is not always an arrayref
The loop through the `_order_by` query parameter occurences introduced
by this patchset was naive regarding the possible scenarios.

When there's only one parameter passed, it shouldn't be expecting an
arrayref, but a scalar. This patch deals with that in the simplest way.

To test:
1. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/REST/Plugin/Objects.t
=> FAIL: Tests are failing
2. Apply this patch
3. Repeat 1
=> SUCCESS: Tests pass!
4. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-06 15:55:06 -03:00
Marcel de Rooy 251aef431b
Bug 33606: (QA follow-up) Cosmetic changes
Even the POD name wasnt changed after copying :)

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-06 12:24:15 -03:00
Jonathan Druart feeb288e30
Bug 33606: Add a erm/config route to retrieve the ERM config needed for the Vue app
This could be extended later in bug 32968 to pass the permission of the
logged in user.

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-06 12:24:13 -03:00
Martin Renvoize c7be846243
Bug 33974: (QA follow-up) Remove superflous import
We don't actually need the Clone import.. it's not used in Biblios.pmt

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 14:51:44 -03:00
Tomas Cohen Arazi c07e43cf2a
Bug 33974: (follow-up) Adapt the orders endpoint
In order to reduce the technical debt carried on the orders controller,
and to highlight the decisions made on the prior patch, I adapted the
list() orders controller using the new tools in town.

The result is this endpoint can now embed bibio, without needing to have
a custom piece of code.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/*.t
=> SUCCESS: Tests pass :-D

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 14:51:44 -03:00
Tomas Cohen Arazi 353f328ad3
Bug 33974: Make biblioitem columns searchable in a generic way
This patch makes biblioitem attributes be searchable on the biblios
endpoint. It does so by using the new method in Koha::Biblios, and by
adjusting objects.search(_rs) to accept a $query_fixer arrayref of
functions to be applied to each query or order_by parameters.

The result is cleaner code to write, but complex internals.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/biblios.t
=> SUCCESS: Tests pass! Searching for biblioitem attributes works on the
API!
3. Sign off :-D

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 14:51:43 -03:00
Tomas Cohen Arazi 252753f84f
Bug 33573: Add public endpoint for cancelling holds
This patch introduces a public endpoint for cancelling holds.
Cancellation requests are generated when the hold is waiting and
configuration allows requesting cancellation, as the OPAC does right
now.

Tests cover all the use cases.

To test:
1. Apply this patches
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/patrons_holds.t
=> SUCCESS: Tests pass!
3. Sign off :-D

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 14:51:31 -03:00
Tomas Cohen Arazi 3fc1f27524
Bug 33971: Remove x-koha-query header support
This patch removes support for the `x-koha-query` header entirely from
the codebase. For the purpose:

- $c->objects->search is adjusted
- Relevant tests are cleared/adapted
- The OpenAPI spec gets the header removed

To test:
1. Apply this patch and run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/REST/Plugin/Objects.t \
           t/Koha/REST/Plugin/Query.t \
           t/db_dependent/api/v1/*.t
=> SUCCESS: Tests pass!
2. Sign off :-D

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 10:35:06 -03:00
Tomas Cohen Arazi f32fe0d39c
Bug 33971: Remove x-koha-query handing in Orders.pm
This patch removes manual handling of `x-koha-query` in the
Orders:list() controller.

There are no tests for the feature but you can verify no behavior is
changed by doing:

1. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/acquisitions_orders.t
=> SUCCESS: Tests pass
2. Apply this patch
3. Repeat 1
=> SUCCESS: Tests pass
4. Sign off :-D

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 10:35:06 -03:00
Tomas Cohen Arazi 871a96552e
Bug 23336: (QA follow-up) Minor fixes
There are two leftover includes, and a couple typos in a comment and POD
title.

This patch fixes that.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 10:35:02 -03:00
Martin Renvoize 918bdd435d
Bug 23336: (QA follow-up) Minor fixes
This patch deals with some QA script warnings, and also makes some
changes in line with bug 33556.

We also adds current user id and checkout item id into the confirmation
token to improve security and fix the failing tests.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 10:35:01 -03:00
Martin Renvoize c5a304b4ca
Bug 23336: (follow-up) Switch to using Koha::Token
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 10:35:00 -03:00
Martin Renvoize 6db025bd9d
Bug 23336: Add checkout API's
This patch adds API's to allow for a checkout flow using the RESTful
API.

We add an availability endpoint to check an items current availability
status. The endpoint can be found at `/checkouts/availability` and is
a GET request that requires item_id and patron_id passed as parameters.

We return an availability object that includes blockers, confirms,
warnings and a confirmation token to be used for checkout.

We also add a corresponding checkout method to the `/checkouts` endpoint.
The method accepts a POST request with checkout details including item_id
, patron_id and the confirmation token in the body.

Future work: We should properly migrate CanBookBeIssued into Koha::* and
use that here instead of refering to C4::Circulation.

Signed-off-by: Silvia Meakins <smeakins@eso.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 10:34:59 -03:00
Lucas Gass df4285adb2
Bug 33176: Enforce RequirePaymentType with API
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-06-12 11:52:06 -03:00
Jonathan Druart deeb5ebdbd
Bug 33904: Fix 2FA registration when library name has non-latin characters
If the library name contains non-latin characters, the 2FA registration
process will fail with a JS alert coming from a 500 server-side.

The problem is that Auth::GoogleAuth is expecting an already UTF8 encoded string.
We should set the encoding correctly to make Auth::GoogleAuth deal with
the URL escaping internally correctly, then decode on our own (in the
REST API controller)

Test plan:
* Modify your logged in library name and add some non-latin characters
(eg. "my ❤ library")
* Turn on TwoFactorAuthentication
* Go to your account > More > Manage 2FA
* Click the enable button
=> Notice that you see the QR code and that both "issuer" and "key id"
entries display the library name correctly.
* Test the whole 2FA process, confirm that the library name is correctly
displayed on the app you are using.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-06-09 08:28:58 -03:00
Owen Leonard 78f1bfaccf
Bug 33859: Use the phrase 'Identity providers' instead of 'Authentication providers'
This patch updates instances in the code and templates where the term
"Authentication providers" is used, replacing it with the preferred
"Identity provider."

Most of the instances of this change are in module or API documentation,
but you can see a couple of the changes in the interface:

- Administration -> Identity providers:
  - The sidebar menu should show "Identity providers" instead of
    "Authentication providers."
- Patrons -> Patron details -> More -> Set permissions
  - Under " Manage Koha system settings (Administration panel)" you
    should see "Manage identity providers (manage_identity_providers)"

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-06-05 14:36:03 -03:00
Tomas Cohen Arazi c84f06ec62
Bug 33854: Fix typo in ImportBatchProfiles controller
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-30 08:05:32 -03:00
Tomas Cohen Arazi 5d191f21e5
Bug 33675: Add CSRF protection to OAuth/OIDC authentication
This patch makes the OAuth/OIDC client pass a `state` parameter with a
CSRF protection token, to be validated back when the flow returns to
Koha.

Ideally, the Mojolicious::Plugin::OAuth2 library should deal with this
implicitly, probably making use of JWT. But as of now, this is the best
way to implement it.

To test:
1. Have a working SSO solution (ktd --sso)
2. Click to login using SSO
=> SUCCESS: Notice a 'state' parameter on the URL, looks like a random
thing
3. When you login, no error is reported

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-19 09:20:54 -03:00
David Cook 05190ed1d9
Bug 33708: Allow anonymous access to OAuth endpoints
Users needs anonymous access to OAuth endpoints so that they can
login, and then use authenticated access for other endpoints.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-18 11:35:16 -03:00
Tomas Cohen Arazi dd512db60b
Bug 33708: Make staff interface login not require public API (OAuth/OIDC)
This patch makes the URL for staff login not point to the `/public`
namespace. The behavior is not changed for the protocol, but as
`/public` requires several settings to be available, it effectively
requires to enable the OPAC, the public API, etc. This patch
diferentiates both to solve the problem.

I've tested following the Wiki instructions to set keycloak [1] using
the *--sso* switch for `ktd` as well [2].

It is important to set the following URLs as allowed redirect in order
to replicate the issue and verify the fix:

http://localhost:8080/api/v1/public/oauth/login/test/opac
http://localhost:8081/api/v1/oauth/login/test/staff

To test:
1. Login into the staff interface using the SSO link:
=> FAIL: Results in a 'Bad redirect URL' error
2. Apply this patch and repeat 1
=> SUCCESS: You get a permission denied error or you just login,
depending on your setup.

[1] https://wiki.koha-community.org/wiki/Testing_SSO
[2] ktd --sso up -d

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-18 11:35:15 -03:00
Agustin Moyano a551cb47ea
Bug 8179: Receive multiple orders
This patch implements the code to allow a patron to receive multiple
orders at the same time in /cgi-bin/koha/acqui/orderreceive.pl page

To test:
1. apply all patches
2. updatedatabase
3. Go to system preferences and allow AcqReceiveMultipleOrderLines
4. In acquisitions module, create a vendor if you don't have one and add
   3 baskets.. one with create items on ordering, one with create items
   on receiving and finally one with create items when cataloguing
5. Fill baskets with orders (There should be at least 15 orders in total). There should be a mix of orders created by suggestions, others by subscriptions and others by neither of those methods.
6. Close all baskets and receive shipment.
CHECK => in /cgi-bin/koha/acqui/parcel.pl page, in top table there is a column with checkboxes, and a button that says "Receive selected"
7. If all orders from all baskets are shown in the table, set the rows per page to 10, so table has more than one page
8. Check some of the checkboxes
CHECK => "Receive selected" button shows how many rows are selected
9. Go to the next page and select some more rows
CHECK => Changing page does not modify how many rows where selected
10. Go back to previous page
CHECK => Previously selected rows are still selected
11. Reload the page to deselect all rows
12. Select only one row and click on "Receive selected" button
CHECK => the page /cgi-bin/koha/acqui/orderreceive.pl behaves just the same as if the "receive" link in the selected row would have been clicked.
13. Click on cancel to go back to parcel.pl page
14. Select all rows (even the ones from the next page of the table) and
    click on "Receive selected"
CHECH => In orderreceive.pl page there is a table with all selected rows
15. Ensure table has more than one page, as in step 7
16. Click on the "edit" link in the last row of the current page
CHECK => A modal window is displayed with 4 tabs within: Info,
Accounting, Receipt history and Items
CHECK => Modal has 4 buttons at the bottom, 'Previous' to go to previos
order, 'Cancel' to close the modal without keeping modifications, 'Save'
to close modal keeping modifications and 'Next' to go to the next order
CHECK => Even that we are at the end of the current page, 'Next' button
is still available
17. Click on 'Next' button
CHECK => The table behind the modal now displays the next page, and the modal was not closed
18. Click on 'Previous'
CHECK => The table behind the modal went back to the first page, and the modal was not closed
19. Click on 'Previous' button till you reach the first row of the first
    page
CHECK => Only when you reach the first row of the first page 'Previous'
button gets disabled
20. Click on 'Next' button till you reach the last row of the last page
CHECK => Only when you reach the last button of the last page 'Next'
button gets disabled
21. Check that behaviour for the different types of order are still the
    same
    a. For orders that where created through suggestion, check that the
suggestion info is present in Info tab. If when suggestion was accepted
you set a reason, a dropdown to change the reason shoul display also.
    b. For orders that where created through subscriptions, check that
the Items tab is disabled, and the Receipt history is enabled. On
accounting tab you should be able to change quantity ordered. If there
were less items received than ordered, the next time you receive this
order the child order generated from this one shoul appear in receipt
history.
    c. For orders that don't come from subscription and creates there items on ordering, Receipt history
should be disabled, and a table with prefilled items shold appear in the
Items tab. You can edit them and the changes should appear in the item's
row.
    d. For orders that don't come from subscription and creates there
items on receiving, Receipt history should be disabled, and a form to
create the items should appear in Items tab. When you add an item a
table should appear.
    e. For orders that don't come from subscription and creates there
ites on cataloguing, Receipt history and Items tabs should be disabled.
    f. Any changes made in quantity (received or ordered) or funds in the modal should be
reflected in the table if you click save from the modal.
22. Once you've done all you checking and verifications click save
23. While saving a progress bar should appear
24. If no error was detected, you should be redirected back to parcel.pl
    page
25. If an error or warning was detected (like there is an order with 0
    items to receive) the save button should be disabled and warnings
are dispayed.
26. prove t/db_dependent/Koha/Acquisition/Fund.t t/db_dependent/Koha/Acquisitoin/Order.t t/db_dependent/Koha/Item.t

Sponsored-by: Virginia Polytechnic Institute and State University
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-15 08:53:47 -03:00
David Gustafsson ddc2906b77
Bug 31735: Avoid re-fetcing objects from database by passing them directly instead of ids to various subroutines
To test:

1) Run the following test and make sure all pass:
  t/db_dependent/api/v1/biblios.t
  t/db_dependent/api/v1/checkouts.t
  t/db_dependent/api/v1/return_claims.t
  t/db_dependent/Circulation/CalcDateDue.t
  t/db_dependent/Circulation/CheckIfIssuedToPatron.t
  t/db_dependent/Circulation/dateexpiry.t
  t/db_dependent/Circulation/GetPendingOnSiteCheckouts.t
  t/db_dependent/Circulation/GetTopIssues.t
  t/db_dependent/Circulation_holdsqueue.t
  t/db_dependent/Circulation/IsItemIssued.t
  t/db_dependent/Circulation/issue.t
  t/db_dependent/Circulation/MarkIssueReturned.t
  t/db_dependent/Circulation/maxsuspensiondays.t
  t/db_dependent/Circulation/ReturnClaims.t
  t/db_dependent/Circulation/Returns.t
  t/db_dependent/Circulation/SwitchOnSiteCheckouts.t
  t/db_dependent/Circulation.t
  t/db_dependent/Circulation/TooMany.t
  t/db_dependent/Circulation/transferbook.t
  t/db_dependent/DecreaseLoanHighHolds.t
  t/db_dependent/Holds/DisallowHoldIfItemsAvailable.t
  t/db_dependent/HoldsQueue.t
  t/db_dependent/Holds/RevertWaitingStatus.t
  t/db_dependent/Illrequests.t
  t/db_dependent/ILSDI_Services.t
  t/db_dependent/Items.t
  t/db_dependent/Koha/Account/Line.t
  t/db_dependent/Koha/Acquisition/Order.t
  t/db_dependent/Koha/Biblio.t
  t/db_dependent/Koha/Holds.t
  t/db_dependent/Koha/Items.t
  t/db_dependent/Koha/Item.t
  t/db_dependent/Koha/Object.t
  t/db_dependent/Koha/Patrons.t
  t/db_dependent/Koha/Plugins/Circulation_hooks.t
  t/db_dependent/Koha/Pseudonymization.t
  t/db_dependent/Koha/Recalls.t
  t/db_dependent/Koha/Recall.t
  t/db_dependent/Koha/Template/Plugin/CirculationRules.t
  t/db_dependent/Letters/TemplateToolkit.t
  t/db_dependent/Members/GetAllIssues.t
  t/db_dependent/Members/IssueSlip.t
  t/db_dependent/Patron/Borrower_Discharge.t
  t/db_dependent/Patron/Borrower_PrevCheckout.t
  t/db_dependent/Reserves/GetReserveFee.t
  t/db_dependent/Reserves.t
  t/db_dependent/rollingloans.t
  t/db_dependent/selenium/regressions.t
  t/db_dependent/SIP/ILS.t
  t/db_dependent/Holds.t
  t/db_dependent/Holds/LocalHoldsPriority.t
  t/db_dependent/Holds/HoldFulfillmentPolicy.t
  t/db_dependent/Holds/HoldItemtypeLimit.t
  t/db_dependent/Circulation/transferbook.t
2) Performe one or more checkouts for a patron, making sure
  that the circulation rules allows for renewals (for example by
  setting an earlier due-date).
3) Log in as this patron in OPAC and make sure the list of
  checkouts is displayed correctly, and that renewing an issue
  still works.

Sponsored-by: Gothenburg University Library
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-12 12:40:21 -03:00
Tomas Cohen Arazi c1fe7406b9
Bug 33053: Handle invalid biblio_id more robustly
This patch addresses the fact the invalid FK error might differ under
some circumstances. We could try to catch the exception adding another
case, but I think this pattern is cleaner and the authors didn't provide
a fix.

We can discuss it later, as this controller class has several things to
review.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-11 16:56:08 -03:00