From d0962904260a95d0976992a7a2ef06eaa230e3a6 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Wed, 23 Jul 2025 18:26:08 -0300
Subject: [PATCH] Bug 36561: Make /auth/password/validation use new permission

This patch updates the /auth/password/validation endpoint to use the new
api_validate_password permission instead of the generic borrowers
permission.

This provides more granular control over who can use the password
validation API endpoint.

To test:
1. Apply this patches
2. Rebuild the API spec
   $ ktd --shell
  k$ yarn api:bundle
3. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/password_validation.t
=> SUCCESS: Tests pass!
4. Sign off :-D

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 812b38d02c0038d2f7e940519fbb7b4c0a08298e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
---
 api/v1/swagger/paths/auth.yaml              |  2 +-
 t/db_dependent/api/v1/password_validation.t | 15 ++++++++++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/api/v1/swagger/paths/auth.yaml b/api/v1/swagger/paths/auth.yaml
index 052565e4de..700023cf55 100644
--- a/api/v1/swagger/paths/auth.yaml
+++ b/api/v1/swagger/paths/auth.yaml
@@ -1183,4 +1183,4 @@
           $ref: ../swagger.yaml#/definitions/error
     x-koha-authorization:
       permissions:
-        borrowers: "1"
+        borrowers: api_validate_password
diff --git a/t/db_dependent/api/v1/password_validation.t b/t/db_dependent/api/v1/password_validation.t
index 74b025d96d..6e59d52a51 100755
--- a/t/db_dependent/api/v1/password_validation.t
+++ b/t/db_dependent/api/v1/password_validation.t
@@ -40,9 +40,22 @@ $schema->storage->txn_begin;
 my $librarian = $builder->build_object(
     {
         class => 'Koha::Patrons',
-        value => { flags => 2**4 }    # borrowers flag = 4
+        value => { flags => 0 }     # No top-level permissions
     }
 );
+
+# Ensure our librarian can see users from all branches (once list_borrowers is added)
+$builder->build(
+    {
+        source => 'UserPermission',
+        value  => {
+            borrowernumber => $librarian->borrowernumber,
+            module_bit     => 4,
+            code           => 'api_validate_password',
+        },
+    }
+);
+
 my $password = 'thePassword123';
 $librarian->set_password( { password => $password, skip_validation => 1 } );
 my $userid = $librarian->userid;