Enable password recovery when using ILS Authentication

config/vufind/SierraRest.ini

@@ -59,6 +59,9 @@ use_prefixed_ids = false
 ; used (redirect_uri above is not set).
 username_field = "code"
 password_field = "pin"
+; Some library systems use a four digit access pin. Others prefer to have alpha numeric
+; passwords. set digits_only to true for pin functionality. Default is false (alpha-num).
+digits_only = true
 ; Authentication method to use with global patron data access. Default is "native".
 ; "ldap" is supported for REST API v6 and later (see api_version above).
 ; IMPORTANT: when using "native" authentication, the driver assumes by default that

module/VuFind/src/VuFind/Auth/ILS.php

@@ -113,6 +113,23 @@ public function authenticate($request)
         return $this->handleLogin($username, $password, $loginMethod, $rememberMe);
     }
 
+    /**
+     * Does this authentication method support password recovery
+     *
+     * @return bool
+     */
+    public function supportsPasswordRecovery()
+    {
+        $driver = $this->getCatalog()->getDriver();
+        if (
+            method_exists($driver, 'recoverPassword')
+            && ($this->config['Authentication']['recover_password'] ?? false)
+        ) {
+            return true;
+        }
+        return false;
+    }
+
     /**
      * Does this authentication method support password changing
      *
@@ -166,8 +183,13 @@ public function updatePassword($request)
         foreach (['oldpwd', 'password', 'password2'] as $param) {
             $params[$param] = $request->getPost()->get($param, '');
         }
-
         // Connect to catalog:
+        if ($hash = $request->getPost('hash') ?? false) {
+            if ($user = $this->getDbService(UserServiceInterface::class)->getUserByVerifyHash($hash)) {
+                $username = $user->getUsername();
+            }
+        }
+
         if (!($patron = $this->authenticator->storedCatalogLogin())) {
             throw new AuthException('authentication_error_technical');
         }
@@ -178,6 +200,55 @@ public function updatePassword($request)
         $result = $this->getCatalog()->changePassword(
             [
                 'patron' => $patron,
+                'username' => $patron['cat_username'],
+                'oldPassword' => $params['oldpwd'],
+                'newPassword' => $params['password'],
+            ]
+        );
+        if (!$result['success']) {
+            throw new AuthException($result['status']);
+        }
+
+        // Update the user and send it back to the caller:
+        $username = $patron[$this->getUsernameField()];
+        $user = $this->getOrCreateUserByUsername($username);
+        $this->authenticator->saveUserCatalogCredentials($user, $patron['cat_username'], $params['password']);
+        return $user;
+    }
+
+    /**
+     * Change/Reset a user's password when they've forgotten.
+     *
+     * @param Request $request Request object containing new account details.
+     *
+     * @return UserEntityInterface Updated user entity.
+     *
+     * @throws PasswordSecurity
+     * @throws AuthException
+     * @throws \Exception
+     */
+    public function newPassword($request)
+    {
+        foreach (['oldpwd', 'password', 'password2'] as $param) {
+            $params[$param] = $request->getPost()->get($param, '');
+        }
+        // Connect to catalog:
+        if ($hash = $request->getPost('hash') ?? false) {
+            if ($user = $this->getDbService(UserServiceInterface::class)->getUserByVerifyHash($hash)) {
+                $username = $user->getUsername();
+            }
+        }
+        if (!($patron = $this->authenticator->storedCatalogLogin($username ?? null))) {
+            throw new AuthException('authentication_error_technical');
+        }
+        $this->validatePasswordUpdate($params);
+        if (empty($params['oldpwd'])) {
+            $params['oldpwd'] = $patron['cat_password'];
+        }
+        $result = $this->getCatalog()->recoverPassword(
+            [
+                'patron' => $patron,
+                'username' => $patron['cat_username'],
                 'oldPassword' => $params['oldpwd'],
                 'newPassword' => $params['password'],
             ]

module/VuFind/src/VuFind/Auth/ILSAuthenticator.php

@@ -309,11 +309,12 @@ public function getStoredCatalogCredentials()
      * fails, clear the user's stored credentials so they can enter new, corrected
      * ones.
      *
-     * Returns associative array of patron data on success, false on failure.
+     * @param $user_name - the username/barcode for ILS password reset
      *
-     * @return array|bool
+     * @return array|bool Returns associative array of patron data on success,
+     * false on failure.
      */
-    public function storedCatalogLogin()
+    public function storedCatalogLogin($user_name = null)
     {
         // Fail if no username is found, but allow a missing password (not every ILS
         // requires a password to connect).
@@ -336,8 +337,22 @@ public function storedCatalogLogin()
                 $this->ilsAccount[$username] = $patron;
                 return $patron;
             }
+        } elseif (!empty($user_name)) {
+            if (isset($this->ilsAccount[$user_name])) {
+                return $this->ilsAccount[$user_name];
+            }
+            $user = $this->getDbService(UserServiceInterface::class)->getUserByUsername($user_name);
+            if (empty($user)) {
+                return false;
+            }
+            $patron = $this->catalog->patronLogin($user_name, $this->getCatPasswordForUser($user));
+            if (empty($patron)) {
+                $user->setCatUsername(null)->setRawCatPassword(null)->setCatPassEnc(null);
+            } else {
+                $this->ilsAccount[$user_name] = $patron;
+                return $patron;
+            }
         }
-
         return false;
     }
 
@@ -347,9 +362,9 @@ public function storedCatalogLogin()
      * @param string $username Catalog username
      * @param string $password Catalog password
      *
-     * Returns associative array of patron data on success, false on failure.
+     * @return array|bool Returns associative array of patron data on success,
+     * false on failure.
      *
-     * @return array|bool
      * @throws ILSException
      */
     public function newCatalogLogin($username, $password)

module/VuFind/src/VuFind/Auth/Manager.php

@@ -670,6 +670,22 @@ public function updatePassword($request)
         return $user;
     }
 
+    /**
+     * Reset a user's password from the request.
+     *
+     * @param \Laminas\Http\PhpEnvironment\Request $request Request object containing
+     * password change details.
+     *
+     * @throws AuthException
+     * @return UserEntityInterface Updated user entity.
+     */
+    public function newPassword($request)
+    {
+        $user = $this->getAuth()->newPassword($request);
+        $this->updateSession($user);
+        return $user;
+    }
+
     /**
      * Update a user's email from the request.
      *

module/VuFind/src/VuFind/Controller/AbstractBase.php

@@ -710,6 +710,14 @@ protected function setFollowupUrlToReferer(bool $allowCurrentUrl = true, array $
         if ($mrhuNorm === $refererNorm) {
             return;
         }
+        // if  is the stored current url of the lightbox
+        // which overrides the url from the server request when present
+        $normReferer = $this->normalizeUrlForComparison($referer);
+        $myUserReset = $this->getServerUrl('myresearch-verify');
+        $murNorm = $this->normalizeUrlForComparison($myUserReset);
+        if (str_starts_with($normReferer, $murNorm)) {
+            return;
+        }
 
         // If the referer is the MyResearch/UserLogin action, it probably means
         // that the user is repeatedly mistyping their password. We should

module/VuFind/src/VuFind/Controller/MyResearchController.php

@@ -186,6 +186,35 @@ protected function processAuthenticationException(AuthException $e)
         $this->flashMessenger()->addMessage($msg, 'error');
     }
 
+    /**
+     * Store a referer (if appropriate) to keep post-login redirect pointing
+     * to an appropriate location. This is used when the user clicks the
+     * log in link from an arbitrary page or when a password is mistyped;
+     * separate logic is used for storing followup information when VuFind
+     * forces the user to log in from another context.
+     *
+     * @param bool  $allowCurrentUrl Whether the current URL is valid for followup
+     * @param array $extras          Extra data for the followup
+     *
+     * @return void
+     */
+    protected function setFollowupUrlToReferer(bool $allowCurrentUrl = true, array $extras = [])
+    {
+        // lbreferer is the stored current url of the lightbox
+        // which overrides the url from the server request when present
+        $refer = $this->getRequest()->getQuery()->get(
+            'lbreferer',
+            $this->getRequest()->getServer()->get('HTTP_REFERER', null)
+        );
+        $normReferer = $this->normalizeUrlForComparison($refer);
+        $myUserReset = $this->getServerUrl('myresearch-verify');
+        $murNorm = $this->normalizeUrlForComparison($myUserReset);
+        if (str_starts_with($normReferer, $murNorm)) {
+            return;
+        }
+        parent::setFollowupUrlToReferer($allowCurrentUrl, $extras);
+    }
+
     /**
      * Maintaining this method for backwards compatibility;
      * logic moved to parent and method re-named
@@ -937,7 +966,7 @@ public function performDeleteFavorite($id, $source)
      * @param UserEntityInterface               $user   Logged-in user
      * @param \VuFind\RecordDriver\AbstractBase $driver Record driver for favorite
      * @param int                               $listID List being edited (null
-     * if editing all favorites)
+     *                                                  if editing all favorites)
      *
      * @return object
      */
@@ -1729,6 +1758,23 @@ public function recoverAction()
         } elseif ($username = $this->params()->fromPost('username')) {
             $user = $userService->getUserByUsername($username);
         }
+        //ILS Driver:
+        //if the user hasn't logged in yet, but is found by the ILS, call function
+        //getPatronFromUsername
+        if (!$user && $this->formWasSubmitted() && !empty($username)) {
+            $dbService = $this->getDbService(UserServiceInterface::class);
+            $entity = $dbService->createEntityForUsername($username);
+            $catalog = $this->getILS()->getDriver();
+            if ($catalog->supportsMethod('getPatronFromUsername', $username)) {
+                $patron = $catalog->getPatronFromUsername($username);
+                $entity->setEmail($patron['email']);
+                $entity->setCatPassEnc($patron['password']);
+                $entity->setFirstname($patron['firstname']);
+                $entity->setLastname($patron['lastname']);
+                $dbService->persistEntity($entity);
+            }
+            $user = $dbService->getUserByUsername($username);
+        }
         $view = $this->createViewModel();
         $view->useCaptcha = $this->captcha()->active('passwordRecovery');
         // If we have a submitted form
@@ -1854,7 +1900,7 @@ protected function sendChangeNotificationEmail($user, $newEmail)
      *
      * @param ?UserEntityInterface $user   User object we're recovering
      * @param bool                 $change Is the user changing their email (true)
-     * or setting up a new account (false).
+     *                                     or setting up a new account (false).
      *
      * @return void (sends email or adds error message)
      */
@@ -2070,18 +2116,23 @@ public function newPasswordAction()
                 return $view;
             }
         }
-        // Update password
+        // Set/Reset password
         try {
-            $user = $this->getAuthManager()->updatePassword($this->getRequest());
+            $user = $this->getAuthManager()->newPassword($this->getRequest());
         } catch (AuthException $e) {
             $this->flashMessenger()->addMessage($e->getMessage(), 'error');
             return $view;
         }
         // Update hash to prevent reusing hash
         $this->getAuthManager()->updateUserVerifyHash($user);
-        // Login
+        if ($followUp = $this->followup()->retrieve('url')) {
+            //This exists because the followupURL gets set to Verify which returns
+            //an error message due to trying to check the hash a second time
+            $followUpUrl = strstr($followUp, 'Verify', true) . 'Home';
+            $this->followup()->clear('url');
+            $this->followup()->store([], $followUpUrl);
+        }
         $this->getAuthManager()->login($this->request);
-        // Return to account home
         $this->flashMessenger()->addMessage('new_password_success', 'success');
         return $this->redirect()->toRoute('myresearch-home');
     }