From b20741c4eb080a904d8652e5673b2117a96efadc Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Sun, 5 Jan 2025 23:47:37 +0000
Subject: [PATCH] Bug 38826: Make check_api_auth $sessionID consistent

This change makes $sessionID consistently return using the session
ID and not sometimes the session object.

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' --cookie-jar /tmp/test.cookies
3. Note the Csrf-Token header value
4. Replace the <CSRF-TOKEN>, <USERID>, and <PASSWORD> tokens in the next step
using the appropriate values (eg the CSRF-TOKEN is from the previous step)
5. curl -v -H "Content-Type: application/x-www-form-urlencoded" \
    -H "Csrf-Token: <CSRF-TOKEN>" -XPOST \
    'http://localhost:8081/cgi-bin/koha/svc/authentication' \
    -d "login_userid=<USERID>&login_password=<PASSWORD>" \
    --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies
6. curl -XGET -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \
    --cookie /tmp/test.cookies > rec.marcxml
7. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' \
    --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies
8. Note the Csrf-Token header value
9. curl -H "Content-Type: text/xml" -H "Csrf-Token: <CSRF-TOKEN>" \
    -XPOST -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \
    --cookie /tmp/test.cookies --data @rec.marcxml

Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 04dbbcc2f24a57e031dae3e1c9066b8a16234736)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
---
 C4/Auth.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 4cd0fe80ea..7710ecb55a 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1634,7 +1634,7 @@ sub check_api_auth {
             -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
             -sameSite => 'Lax'
         );
-        return ( $return, $cookie, $session ); # return == 'ok' here
+        return ( $return, $cookie, $session->id ); # return == 'ok' here
 
     } else {