https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916
--- Comment #17 from Tomás Cohen Arazi (tcohen) <[email protected]> --- Created attachment 205477 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=205477&action=edit Bug 42916: Add attribute-level permissions framework (x-mod-permissions) This patch adds a framework for declaring attribute-level permissions in the OpenAPI specification. A body property can carry an x-mod-permissions extension listing the permissions required to modify it: priority: type: integer x-mod-permissions: reserveforothers: modify_holds_priority The mapping is parsed once during the authentication chain and stashed for later use; it is then enforced automatically on PATCH requests, so no per-controller code is required. The explicit helper remains available for controllers that need to validate a body manually. Changes: - Add Koha::REST::Plugin::AttributePermissions, registering two helpers: - stash_attribute_permissions({ spec => $spec }): parses the operation body properties for x-mod-permissions and stashes the attribute -> permissions mapping under koha.attribute_permissions - validate_attribute_permissions($body): enforces the stashed mapping with haspermission(), throwing 403 (naming the offending attribute) - Register the plugin in Koha::REST::V1 - Koha::REST::V1::Auth::authenticate_api_request stashes the mapping and automatically enforces it for PATCH requests at both success paths - Add a PATCH fixture route and controller action to the Test plugin - No changes to existing controllers Test plan: 1. Apply patch 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/attribute_permissions.t => SUCCESS: Tests pass! 3. Tests cover: - Ungated attribute allowed with the base permission - Gated attribute rejected with 403 without the attribute permission - Mixed body rejected when a gated attribute is present - Gated attribute allowed when the user has the attribute permission 4. Sign off :-D Assisted-by: Sonnet 4.6 (Anthropic) -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
