From ce42c3b5eca8d0289cb6bc3e7922ef935725766f Mon Sep 17 00:00:00 2001 From: Jan Kissig Date: Fri, 13 Mar 2026 10:18:29 +0000 Subject: [PATCH] Bug 35380: Make updateBiblio-API respect Record overlay rules This patch moves hardcoded source filter from 'MARC overlay rules' (batchmod, intranet, z3950, staged import, bulk import, import_lexile) to 'Record Sources' and makes them untouchable. They cannot be renamed or modified. New record sources can be added and modified though. All default and newly created record sources are available as filter for the module "Source" in 'MARC overlay rules'. The API route for PUT /biblios/:biblio_id now checks for a given header x-record-source-id. If an id is given the name of the rule is retrieved and forwarded as an overlay_context to ModBiblio. If no id is given the fallback '*' is added as overlay_context. Also the record source id is getting saved. Test plan: pre) run perl installer/data/mysql/updatedatabase.pl to add new is_system column pre) run dbic to build Koha::Schema::Result::RecordSource as it gets a new columns is_system pre) run 'redocly bundle --ext json api/v1/swagger/swagger.yaml --output api/v1/swagger/swagger_bundle.json' or 'yarn build' a) enable system preference MARCOverlayRules and RESTBasicAuth b) create new record source in /cgi-bin/koha/admin/record_sources and recognize its and c) create overlay rules in /cgi-bin/koha/admin/marc-overlay-rules.pl f.e. +----+-----+--------+----------+-----------+ | id | tag | module | filter | preset | +----+-----+--------+----------+-----------+ | 1 | 245 | source | * | protect | +----+-----+--------+----------+-----------+ This will make the 245 field protected from change, unless the record source matches d) go to /cgi-bin/koha/catalogue/detail.pl?biblionumber=262 and change 245 (title) via edit -> edit record e) save and take a look the title is still the same f) run the updateBiblio-Request from below with a API-testing client like REST Client g) check that title gets overwritten even though it is protected. This is due the fact the updateBiblio is not setting an overlay context. h) apply patch redo d) and e) i) add another overlay rule allowing your record source to change 245: +----+-----+--------+----------+-----------+ | id | tag | module | filter | preset | +----+-----+--------+----------+-----------+ | 1 | 245 | source | * | protect | | 2 | 245 | source | | overwrite | +----+-----+--------+----------+-----------+ j) run the updateBiblio-Request from below, be sure to fill out x-record-source-id:with your ID from step b) k) check that title gets overwritten l) run the updateBiblio-Request from below, but omit x-record-source-id or set it to another value than m) check that title is not overwritten PUT http://main-intra.localhost/api/v1/biblios/262 Authorization: Basic koha:koha Authorization: Basic koha:koha Content-Type: application/marcxml+xml x-record-source-id: 01075cam a2200313 a 4500 foo 20200421093825.0 120417s2012 ch a b 001 0 eng 482 Christiansen, Tom. 482 New Title Tom Christiansen, Brian D. Foy & Larry Wall. City Pages and more BKS Signed-off-by: David Nind Signed-off-by: Martin Renvoize --- Koha/REST/V1/Biblios.pm | 55 +++++++++++++++++++++++++++++-- api/v1/swagger/paths/biblios.yaml | 5 +++ 2 files changed, 58 insertions(+), 2 deletions(-) diff --git a/Koha/REST/V1/Biblios.pm b/Koha/REST/V1/Biblios.pm index a4d50e3800..c9d59e5860 100644 --- a/Koha/REST/V1/Biblios.pm +++ b/Koha/REST/V1/Biblios.pm @@ -22,6 +22,7 @@ use Mojo::Base 'Mojolicious::Controller'; use Koha::Biblios; use Koha::DateUtils; use Koha::Ratings; +use Koha::RecordSources; use C4::Biblio qw( DelBiblio AddBiblio ModBiblio ); use C4::Search qw( FindDuplicate ); @@ -720,9 +721,14 @@ sub update { my $biblio = Koha::Biblios->find( $c->param('biblio_id') ); - $c->render_resource_not_found("Bibliographic record") + return $c->render_resource_not_found("Bibliographic record") unless $biblio; + return $c->render( + status => 403, + openapi => { error => 'You do not have permission to edit a locked record' } + ) unless ( $biblio->can_be_edited( $c->stash('koha.user') ) ); + try { my $headers = $c->req->headers; @@ -753,7 +759,52 @@ sub update { ); } - ModBiblio( $record, $biblio->id, $frameworkcode ); + my $record_source_id = $headers->header('x-record-source-id'); + + my $options = { + overlay_context => { + userid => $c->stash('koha.user')->userid, + categorycode => $c->stash('koha.user')->categorycode, + } + }; + + if ($record_source_id) { + + # We've been passed a record source. Verify they are allowed to + unless ( + haspermission( + $c->stash('koha.user')->userid, + { editcatalogue => 'set_record_sources' } + ) + ) + { + return $c->render( + status => 403, + openapi => { error => 'You do not have permission to set the record source' } + ); + } + + # find record source name to given id + my $record_source = Koha::RecordSources->search( { record_source_id => $record_source_id } )->single; + + unless ($record_source) { + return $c->render( + status => 409, + openapi => { error => 'Given record_source_id does not exist' } + ); + } + + $options->{'overlay_context'}->{'source'} = $record_source->name; + + # this will update the record source id in biblio metadata + $options->{'record_source_id'} = $record_source_id; + } + + unless ( $options->{'overlay_context'}->{'source'} ) { + $options->{'overlay_context'}->{source} = '*'; + } + + ModBiblio( $record, $biblio->id, $frameworkcode, $options ); $c->render( status => 200, diff --git a/api/v1/swagger/paths/biblios.yaml b/api/v1/swagger/paths/biblios.yaml index 18120c5dd9..94a5092c93 100644 --- a/api/v1/swagger/paths/biblios.yaml +++ b/api/v1/swagger/paths/biblios.yaml @@ -251,6 +251,7 @@ - $ref: "../swagger.yaml#/parameters/framework_id_header" - $ref: "../swagger.yaml#/parameters/marc_schema_header" - $ref: "../swagger.yaml#/parameters/confirm_not_duplicate_header" + - $ref: "../swagger.yaml#/parameters/record_source_id_header" produces: - application/json responses: @@ -279,6 +280,10 @@ description: Accepted content-types items: type: string + "409": + description: Conflict + schema: + $ref: "../swagger.yaml#/definitions/error" "500": description: | Internal server error. Possible `error_code` attribute values: