From 11e919cc1974d278fb28a2fb6b7a38ca3fe178e2 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Tue, 28 Nov 2023 22:57:39 +0000
Subject: [PATCH] Bug 34893: Add checkpw change to REST API

This patch adds the checkpw return value change to the REST API
route for validating user identifiers and password.

Test plan:
0. Apply patch
1. prove t/db_dependent/api/v1/password_validation.t

Bonus points:
1. koha-plack --reload kohadev
2. Enable syspref RESTBasicAuth
3. curl -XPOST -H "Content-Type: application/json" \
-u <staff_userid>:<staff_password> \
-d '{"identifier":"<cardnumber>","password":"<password>"}' \
http://localhost:8081/api/v1/auth/password/validation
4. Validation doesn't fail. It gives you cardnumber, patron_id, userid

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
---
 Koha/REST/V1/Auth/Password.pm | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/Koha/REST/V1/Auth/Password.pm b/Koha/REST/V1/Auth/Password.pm
index 9889bf45a7..189dcc80d5 100644
--- a/Koha/REST/V1/Auth/Password.pm
+++ b/Koha/REST/V1/Auth/Password.pm
@@ -71,7 +71,7 @@ sub validate {
     my $password = $body->{password} // "";
 
     return try {
-        my ( $status, $THE_cardnumber, $THE_userid ) = C4::Auth::checkpw( $identifier, $password );
+        my ( $status, $THE_cardnumber, $THE_userid, $patron ) = C4::Auth::checkpw( $identifier, $password );
         unless ( $status && $status > 0 ) {
             my $error_response = $status == -2 ? 'Password expired' : 'Validation failed';
             return $c->render(
@@ -80,8 +80,6 @@ sub validate {
             );
         }
 
-        my $patron = Koha::Patrons->find( { cardnumber => $THE_cardnumber } );
-
         return $c->render(
             status  => 201,
             openapi => {
-- 
2.39.5