Merge pull request #137 from outis1one/claude/pensive-wright-ko0ipl

Claude/pensive wright ko0ipl

library/README.md

@@ -1,4 +1,4 @@
-# Home library: Koha + Quick Add (Docker)
+# Room for Books: a home library (Koha + the Room for Books site, in Docker)
 
 A self-hosted library catalogue you can set up in one command:
 
@@ -203,3 +203,85 @@ koha/                 Dockerfile (Koha from the project's Debian repo), entrypoi
                       servers, label templates/layouts)
 quickadd/             the scan-to-add service (Python standard library + yaz)
 ```
+
+## Signing in once
+
+Staff who are signed in to the library site (and allowed to edit the catalogue) open **Add books** without a second login. Koha itself confirms the sign-in; the shared secret is `SSO_SECRET` in `.env`. The read-only `guest` login still uses the Add books prompt, and the direct Add books port never accepts a Koha sign-in. If `SSO_SECRET` is empty, Add books just asks for its own login as before.
+
+## The home page (the Room for Books site at `/add/`)
+
+One simple page: a **Look up** box (books by title, author or ISBN, and people by name or card number), four big buttons
+(**Check out**, **Return**, **Add books**, **Add a person**) and **Recently added** books with their covers. The **menu**
+(top right) holds the rest: browse all books, lend / return, people and library cards, barcodes and settings, export / import,
+and a link to Koha's own staff screens. Borrowers and the read-only guest see just the lookup, recent books and (borrowers) My books.
+
+**Adding by title:** on Add books, scan or type an ISBN to add it straight away; type a title or author instead and you get a list
+of matches (cover, author, year, publisher) from Open Library and the Library of Congress to choose from. Books you already have
+are marked, with an *Add another copy* button.
+
+## Everyday use (details)
+
+One page for the day-to-day, so you rarely need Koha's own screens:
+
+- **Library**: a cover grid of everything you own. Search by title, author or ISBN; filter by shelf, format
+  (book/DVD/CD) and status (on the shelf / checked out); sort by title, author or newest. Click a book for its
+  page: copies with barcode, status, who has it and when it is due; change a copy's shelf or call number,
+  add another copy, remove a copy, or delete the book. (Title/author edits are one click away in Koha.)
+- **Lend / return**: scan or type a library card number (or search by name), then scan books to check them out;
+  "Return a book" takes a scan with no person needed; **Renew** extends a loan; the list below shows everything
+  that is out, overdue ones flagged. Check-in goes through Koha's own check-in code, so holds and rules still apply.
+- **People**: add someone with just a name (the card number is assigned automatically), search, and
+  **Print card** for a library card with a scannable Code 39 barcode.
+- **Add books**: scan an ISBN (or use the phone camera), as before.
+
+The read-only `guest` login only sees the Library and book pages (no copy status names, no editing, no lending).
+
+### Collections, QR cards, more about a book
+
+- **Collections** (Kids, Cookbooks, ...) are per copy, shown on the book page next to the shelf, and filterable on the
+  Library page. Choose **+ New collection...** (or **+ New shelf...**) in the dropdown to add one: no Koha screens needed.
+- **Library cards** carry a Code 39 barcode and a **QR code** of the card number. **Save as picture** makes an image to text
+  or AirDrop to a phone; on Lend / return, **Scan card or phone QR with camera** reads either one from a photo.
+  **Print everyone's cards** (People) lays out a sheet of cards.
+- **More about a book**: a description and subjects from Open Library, plus look-up links (Goodreads, LibraryThing,
+  WorldCat). **AR BookFind** is a link only: Renaissance's terms forbid automated access, so nothing is fetched from it.
+
+### Reading levels (AR) and spreadsheets
+
+AR BookFind has no public feed or import, and its terms forbid automated look-ups, so this site does not fetch from it.
+Instead: the book page has an **Open AR BookFind** link (plus **Copy title** to paste into its search) and boxes to record the
+**level, points and quiz number** you find there (the read-only guest sees them). **Library page -> Export / import** downloads
+`library.csv` (one row per copy, with any reading level) and imports a CSV of `isbn, level, points[, quiz]` you made yourself
+(for example from a spreadsheet or a Renaissance report you are entitled to export). Levels are stored in `reading-levels.json`
+in the Add books data volume, keyed by ISBN, so they survive a Koha reinstall and are included in the usual backups of that folder.
+
+### Live camera scanning (needs HTTPS)
+
+Browsers only allow a live camera on HTTPS pages (or on the machine itself). Put the library site behind Caddy with a real
+certificate and **Live scan** buttons appear: Add books (scan a stack of ISBNs one after another), Lend / return (live card or
+phone-QR scan, live book check-out for the chosen person, live returns). Chrome on Android reads codes in the browser; other
+browsers send small camera frames to the server's decoder a couple of times a second. On plain HTTP the photo buttons stay.
+
+### Copying reading levels from AR BookFind
+
+On the AR BookFind book page, select everything (Ctrl/Cmd+A), copy, and paste into the box on the book page here: the level,
+points, quiz number and interest level fill in by themselves; check them and press Save.
+
+### Tags, and borrowers signing in
+
+- **Tags**: any number per book (to read, kids, signed...). Add and remove them on the book page; click one to see every
+  book that has it; the Library page can filter by tag. They are stored in `tags.json` in the Add books data volume, which
+  the usual backups of that folder include.
+- **Borrowers sign in**: every person gets a login, **their library card number + a password**. Adding someone shows
+  their password once (a different easy one like `maple482`, or the same one for everyone: People -> *Sign-in passwords for new
+  people*). *Give everyone a sign-in* covers people added earlier; *New password* resets one person. A borrower who signs in
+  sees the library and a **My books** page: what they have out, when each is due (or overdue), **Renew**, and **Change my
+  password**. They cannot lend, edit or see other people. Passwords are Koha's own patron passwords; this stack relaxes Koha's
+  default strength rule (4+ characters instead of 8 with upper/lower/digit) once, at install or update.
+  Ten wrong guesses from one address locks sign-in attempts from it for five minutes.
+
+### Reading levels: pop-up or in-page AR BookFind
+
+The book page's AR box has **Open beside this page** (a pop-up window next to the book) and **Show it here** (AR BookFind inside the
+page; some browsers block its cookies inside another page, then use the pop-up). Either copies the title first so you can paste
+it into AR's search; AR's own page cannot be pre-filled from here.

library/docker-compose.yml

@@ -35,6 +35,7 @@ services:
     environment:
       TZ: ${TZ:-UTC}
       KOHA_QUICKADD_URL: http://quickadd:8082
+      KOHA_SSO_SECRET: ${SSO_SECRET:-}
       KOHA_DB_HOST: db
       KOHA_DB_PASS: ${DB_PASSWORD}
       KOHA_ADMIN_USER: ${ADMIN_USER:-admin}
@@ -60,6 +61,7 @@ services:
     environment:
       TZ: ${TZ:-UTC}
       KOHA_API: http://koha:8081/api/v1
+      SSO_SECRET: ${SSO_SECRET:-}
       ADMIN_USER: ${ADMIN_USER:-admin}
       ADMIN_PASSWORD: ${ADMIN_PASSWORD}
       VIEWER_USER: ${VIEWER_USER:-guest}

library/install.sh

@@ -127,6 +127,8 @@ ADMIN_USER=admin
 ADMIN_PASSWORD=$(rand 16)
 VIEWER_USER=guest
 VIEWER_PASSWORD=$(rand 14)
+# Lets the library site vouch for a signed-in staff user to the Add books page (no second login).
+SSO_SECRET=$(rand 40)
 DB_ROOT_PASSWORD=$(rand 32)
 DB_PASSWORD=$(rand 32)
 KOHA_SUITE=stable
@@ -142,6 +144,7 @@ else
     if ! grep -q '^VIEWER_PASSWORD=' .env; then
         { echo "VIEWER_USER=guest"; echo "VIEWER_PASSWORD=$(rand 14)"; } >> .env
     fi
+    grep -q '^SSO_SECRET=' .env || echo "SSO_SECRET=$(rand 40)" >> .env
     # Existing installs keep their current public-catalogue behaviour.
     grep -q '^OPAC_BIND=' .env || echo "OPAC_BIND=0.0.0.0" >> .env
     if ! grep -q '^BIND_ADDR=' .env; then

library/koha/Dockerfile

@@ -39,6 +39,12 @@ RUN for c in koha-create koha-plack koha-zebra koha-rebuild-zebra koha-upgrade-s
       command -v "$c" >/dev/null || { echo "BUILD ERROR: $c is missing from the image" >&2; exit 1; }; \
     done
 
+# The endpoint Quick Add uses to recognise a signed-in staff user (see the file header).
+COPY quickadd-session.pl /usr/share/koha/intranet/cgi-bin/svc/quickadd-session
+# (the return script lives beside the staff .pl scripts, not under svc/: Koha's svc Plack app 500s on it)
+COPY quickadd-return.pl quickadd-value.pl /usr/share/koha/intranet/cgi-bin/
+RUN chmod 0755 /usr/share/koha/intranet/cgi-bin/svc/quickadd-session /usr/share/koha/intranet/cgi-bin/quickadd-return.pl /usr/share/koha/intranet/cgi-bin/quickadd-value.pl
+
 COPY bootstrap.pl ensure.pl entrypoint.sh /opt/koha-init/
 COPY seed/ /opt/koha-init/seed/
 RUN chmod 0755 /opt/koha-init/entrypoint.sh && chmod -R a+rX /opt/koha-init

library/koha/ensure.pl

@@ -7,6 +7,7 @@ use Modern::Perl;
 use C4::Context;
 use Koha::Patrons;
 use Koha::Patron::Categories;
+use Koha::Caches;
 
 my $dbh  = C4::Context->dbh;
 # The read-only "guest" login lives in Quick Add only (the Find a book page), NOT in Koha:
@@ -20,16 +21,35 @@ if ( my $cat = Koha::Patron::Categories->find('VIEWER') ) {
     $cat->delete unless Koha::Patrons->search( { categorycode => 'VIEWER' } )->count;
 }
 
-# Staff home page block (Koha 26.05 keeps these in the HTML customizations tool).
+# Patron logins use short, easy-to-remember passwords (a home library, not a bank): Koha's defaults
-my ($have) = $dbh->selectrow_array(q{SELECT COUNT(*) FROM additional_contents WHERE code = 'library_tools'});
+# (8+ characters, upper+lower+digit) are relaxed once, unless an admin has changed them since.
-unless ($have) {
+my $flag = '/var/lib/koha/' . ( $ENV{KOHA_INSTANCE} || 'library' ) . '/.password-policy-set';
-    my $html = '<div class="main-heading"><h3>Library tools</h3></div><ul class="list-unstyled">'
+unless ( -e $flag ) {
-        . '<li><a class="btn btn-primary" href="/add/#find">Find a book</a></li>'
+    my ($strong) = $dbh->selectrow_array(q{SELECT value FROM systempreferences WHERE variable = 'RequireStrongPassword'});
-        . '<li><a href="/add/">Add books (scan an ISBN)</a></li></ul>';
+    my ($minlen) = $dbh->selectrow_array(q{SELECT value FROM systempreferences WHERE variable = 'minPasswordLength'});
+    if ( ( $strong // 1 ) == 1 && ( $minlen // 8 ) == 8 ) {
+        $dbh->do(q{UPDATE systempreferences SET value = 0 WHERE variable = 'RequireStrongPassword'});
+        $dbh->do(q{UPDATE systempreferences SET value = 4 WHERE variable = 'minPasswordLength'});
+        say "ensure: patron passwords may be short (4+ characters, no strength rule)";
+        Koha::Caches->get_instance->flush_all;    # preferences are cached; direct SQL edits need this
+    }
+    if ( open my $fh, '>', $flag ) { close $fh }
+}
+
+# Staff home page block (Koha 26.05 keeps these in the HTML customizations tool). Rewritten each start.
+my $html = '<div class="main-heading"><h3>Room for Books</h3></div><ul class="list-unstyled">'
+    . '<li><a class="btn btn-primary" href="/add/">Open Room for Books</a> (library, lend / return, people, add books)</li>'
+    . '<li><a href="/add/#find">Find a book</a></li></ul>';
+my ($id) = $dbh->selectrow_array(q{SELECT id FROM additional_contents WHERE code = 'library_tools'});
+unless ($id) {
     $dbh->do(q{INSERT INTO additional_contents (category, code, location, branchcode, published_on, number)
                VALUES ('html_customizations', 'library_tools', 'IntranetmainUserblock', NULL, CURDATE(), 1)});
-    my $id = $dbh->last_insert_id( undef, undef, 'additional_contents', 'id' );
+    $id = $dbh->last_insert_id( undef, undef, 'additional_contents', 'id' );
     $dbh->do( q{INSERT INTO additional_contents_localizations (additional_content_id, title, content, lang)
-                VALUES (?, 'Library tools', ?, 'default')}, undef, $id, $html );
+                VALUES (?, 'Room for Books', ?, 'default')}, undef, $id, $html );
-    say "ensure: added the staff home 'Library tools' block";
+    say "ensure: added the staff home 'Room for Books' block";
+}
+else {
+    $dbh->do( q{UPDATE additional_contents_localizations SET title = 'Room for Books', content = ? WHERE additional_content_id = ? AND lang = 'default'},
+        undef, $html, $id );
 }

library/koha/entrypoint.sh

@@ -60,22 +60,36 @@ if [ ! -d "/etc/koha/sites/$INST" ]; then
     # (The staff and public catalogue sites cannot share one address: Koha gives both the
     # same URL shapes. The staff site is the natural home for a home library.)
     if [ -n "${KOHA_QUICKADD_URL:-}" ]; then
+        # Single sign-on for staff: when KOHA_SSO_SECRET is set, this web server tells Quick Add (via a
+        # secret header nobody outside can forge: it is overwritten here on every request) that the
+        # request came through the staff site, and Quick Add then asks Koha whether the browser's login
+        # cookie belongs to a staff user who may edit the catalogue. Without the secret, or if anything
+        # about that fails, Quick Add just asks for its own login as before.
+        SSO_BLOCK=""
+        if [ -n "${KOHA_SSO_SECRET:-}" ]; then
+            install -m 0640 -o root -g "$INST-koha" /dev/null /etc/koha/quickadd-sso.secret
+            printf '%s' "$KOHA_SSO_SECRET" > /etc/koha/quickadd-sso.secret
+            SSO_BLOCK="    <IfModule mod_headers.c>
+        <Location /add/>
+            RequestHeader set X-Quickadd-Proxy \"$KOHA_SSO_SECRET\"
+        </Location>
+    </IfModule>"
+        fi
         cat > /etc/koha/apache-quickadd.conf << APACHE
 <IfModule mod_proxy_http.c>
     RedirectMatch ^/add\$ /add/
     ProxyPass /add/ ${KOHA_QUICKADD_URL%/}/
     ProxyPassReverse /add/ ${KOHA_QUICKADD_URL%/}/
+${SSO_BLOCK}
 </IfModule>
 APACHE
         sed -i 's|^\(\s*\)Include /etc/koha/apache-shared-intranet.conf|&\n\1Include /etc/koha/apache-quickadd.conf|' "/etc/apache2/sites-available/$INST.conf"
     fi
 
-    # Run Apache itself as the instance user instead of mpm_itk's per-vhost
-    # uid switching (which needs extra capabilities and is pointless here:
-    # Plack does the real work as that user already).
     # koha-create insists on mpm_itk being enabled, but inside a container it can
     # not switch users (initgroups: Operation not permitted -> HTTP 500 on every
-    # page). Now that the instance exists, swap to plain prefork.
+    # page). Now that the instance exists, swap to plain prefork; Apache runs as the
+    # instance user (Plack does the real work as that user already).
     rm -f /etc/apache2/mods-enabled/mpm_itk.*
     a2enmod mpm_prefork >/dev/null 2>&1 || true
     sed -i '/AssignUserID/d' "$SITE"

library/koha/quickadd-return.pl

@@ -0,0 +1,53 @@
+#!/usr/bin/perl
+# Installed as .../intranet/cgi-bin/quickadd-return.pl (URL /cgi-bin/koha/quickadd-return.pl).
+#
+# Koha's REST API has no "check in" call, so the Add books / Lend page asks this small script to do it
+# with Koha's own C4::Circulation::AddReturn (the same code the staff Check in screen runs: it clears
+# the loan, handles holds and fines rules). Same shared-secret guard as quickadd-session: only callers
+# that know the secret get an answer.
+use Modern::Perl;
+use CGI qw( -utf8 );
+use JSON qw( encode_json );
+use Digest::SHA qw( sha256_hex );
+use C4::Context;
+use C4::Circulation qw( AddReturn );
+use Koha::Items;
+
+my $q = CGI->new;
+
+sub reply {
+    my ( $q, $status, $data ) = @_;
+    print $q->header( -type => 'application/json', -status => $status, -charset => 'utf-8', -cache_control => 'no-store' ),
+        encode_json($data);
+    exit;
+}
+
+my $secret = '';
+if ( open my $fh, '<', '/etc/koha/quickadd-sso.secret' ) { $secret = <$fh> // ''; $secret =~ s/\s+$//; close $fh }
+my $given = $ENV{HTTP_X_QUICKADD_SECRET} // '';
+reply( $q, '403 Forbidden', { status => 'forbidden' } )
+    unless length($secret) >= 16 && sha256_hex($given) eq sha256_hex($secret);
+
+my $barcode = $q->param('barcode') // '';
+reply( $q, '200 OK', { status => 'invalid' } ) unless $barcode =~ /\A[\x21-\x7e]{1,40}\z/;
+
+my $item = Koha::Items->find( { barcode => $barcode } );
+reply( $q, '200 OK', { status => 'unknown_barcode' } ) unless $item;
+
+# AddReturn needs to know which branch it is happening at.
+my $branch = $item->homebranch;
+my ( $doreturn, $messages, $borrower, $was_out );
+eval {
+    C4::Context->set_userenv( 0, 0, 'quickadd', 'Quick', 'Add', $branch, $branch, 0, '', '' );
+    $was_out = $item->checkout ? 1 : 0;
+    ( $doreturn, $messages, undef, $borrower ) = AddReturn( $barcode, $branch );
+    1;
+} or reply( $q, '200 OK', { status => 'failed', error => "$@" } );
+reply(
+    $q, '200 OK',
+    {
+        status   => $doreturn && $was_out ? 'returned' : ( $doreturn || exists $messages->{NotIssued} ) ? 'not_out' : 'failed',
+        patron   => $borrower ? ( join ' ', grep { length } $borrower->{firstname}, $borrower->{surname} ) : '',
+        messages => [ sort keys %{ $messages || {} } ],
+    }
+);

library/koha/quickadd-session.pl

@@ -0,0 +1,44 @@
+#!/usr/bin/perl
+# Installed as .../intranet/cgi-bin/svc/quickadd-session (URL /cgi-bin/koha/svc/quickadd-session).
+#
+# Lets the Add books page (Quick Add) ask: "is this browser signed in to the staff site as
+# someone allowed to edit the catalogue?" so staff do not have to log in a second time.
+#
+# It wraps Koha's own C4::Auth::check_cookie_auth (documented for exactly this: services that
+# are invoked by pages authenticated in the usual way) and only answers callers that present a
+# shared secret, so it cannot be used to probe sessions from outside. The browser's address is
+# passed in explicitly, so Koha's "session is tied to the IP that logged in" rule keeps working.
+use Modern::Perl;
+use CGI qw( -utf8 );
+use JSON qw( encode_json );
+use Digest::SHA qw( sha256_hex );
+use C4::Auth qw( check_cookie_auth );
+
+my $q = CGI->new;
+
+# Takes the CGI object as an argument: under Plack this file runs wrapped in a sub, where a named
+# sub would otherwise see a stale copy of a file-level variable.
+sub reply {
+    my ( $q, $status, $data ) = @_;
+    print $q->header( -type => 'application/json', -status => $status, -charset => 'utf-8', -cache_control => 'no-store' ),
+        encode_json($data);
+    exit;
+}
+
+# 1. The caller must know the shared secret (a file only the Koha user and root can read).
+my $secret = '';
+if ( open my $fh, '<', '/etc/koha/quickadd-sso.secret' ) { $secret = <$fh> // ''; $secret =~ s/\s+$//; close $fh }
+my $given = $ENV{HTTP_X_QUICKADD_SECRET} // '';
+reply( $q, '403 Forbidden', { status => 'forbidden' } )
+    unless length($secret) >= 16 && sha256_hex($given) eq sha256_hex($secret);
+
+# 2. Plausible-looking inputs only.
+my $sid = $q->param('sid') // '';
+my $ip  = $q->param('ip')  // '';
+reply( $q, '200 OK', { status => 'failed' } )
+    unless $sid =~ /\A[A-Za-z0-9]{16,64}\z/ && $ip =~ /\A[0-9A-Fa-f:.]{3,45}\z/;
+
+# 3. Ask Koha. Staff who may edit the catalogue (superlibrarians always may) are let in.
+my ( $status, $session ) = check_cookie_auth( $sid, { editcatalogue => 'edit_catalogue' }, { remote_addr => $ip } );
+reply( $q, '200 OK', { status => 'ok', user => scalar $session->param('id') } ) if $status eq 'ok' && $session;
+reply( $q, '200 OK', { status => $status || 'failed' } );

library/koha/quickadd-value.pl

@@ -0,0 +1,42 @@
+#!/usr/bin/perl
+# Installed as .../intranet/cgi-bin/quickadd-value.pl (URL /cgi-bin/koha/quickadd-value.pl).
+#
+# Koha's REST API cannot add shelves/rooms (authorised value category LOC) or collections (CCODE),
+# so the Library site asks this script to, with Koha's own Koha::AuthorisedValue class. Same shared-secret
+# guard as quickadd-session / quickadd-return; only the two categories below can be touched.
+use Modern::Perl;
+use CGI qw( -utf8 );
+use JSON qw( encode_json );
+use Digest::SHA qw( sha256_hex );
+use Koha::AuthorisedValues;
+use Koha::AuthorisedValue;
+
+my $q = CGI->new;
+
+sub reply {
+    my ( $q, $status, $data ) = @_;
+    print $q->header( -type => 'application/json', -status => $status, -charset => 'utf-8', -cache_control => 'no-store' ),
+        encode_json($data);
+    exit;
+}
+
+my $secret = '';
+if ( open my $fh, '<', '/etc/koha/quickadd-sso.secret' ) { $secret = <$fh> // ''; $secret =~ s/\s+$//; close $fh }
+my $given = $ENV{HTTP_X_QUICKADD_SECRET} // '';
+reply( $q, '403 Forbidden', { status => 'forbidden' } )
+    unless length($secret) >= 16 && sha256_hex($given) eq sha256_hex($secret);
+
+my $cat   = $q->param('category') // '';
+my $value = $q->param('value')    // '';
+my $desc  = $q->param('description') // '';
+utf8::decode($desc);
+reply( $q, '200 OK', { status => 'invalid' } )
+    unless $cat =~ /\A(?:LOC|CCODE)\z/ && $value =~ /\A[A-Z0-9_-]{1,20}\z/ && length($desc) && length($desc) <= 80;
+
+my $out = eval {
+    my $exists = Koha::AuthorisedValues->search( { category => $cat, authorised_value => $value } )->count;
+    return { status => 'exists' } if $exists;
+    Koha::AuthorisedValue->new( { category => $cat, authorised_value => $value, lib => $desc, lib_opac => $desc } )->store;
+    { status => 'added' };
+};
+reply( $q, '200 OK', $out // { status => 'failed', error => "$@" } );

library/quickadd/Dockerfile

@@ -5,7 +5,7 @@ FROM debian:bookworm-slim
 ENV DEBIAN_FRONTEND=noninteractive PYTHONUNBUFFERED=1
 
 RUN apt-get update \
- && apt-get install -y --no-install-recommends ca-certificates python3 yaz zbar-tools tzdata \
+ && apt-get install -y --no-install-recommends ca-certificates python3 yaz zbar-tools qrencode tzdata \
  && rm -rf /var/lib/apt/lists/*
 
 # Optional: drop extra CA certificates (*.crt) into ./certs/ before building if
@@ -13,7 +13,7 @@ RUN apt-get update \
 COPY certs/ /usr/local/share/ca-certificates/extra/
 RUN update-ca-certificates
 
-RUN command -v yaz-client >/dev/null && command -v yaz-marcdump >/dev/null && command -v python3 >/dev/null && command -v zbarimg >/dev/null
+RUN command -v yaz-client >/dev/null && command -v yaz-marcdump >/dev/null && command -v python3 >/dev/null && command -v zbarimg >/dev/null && command -v qrencode >/dev/null
 
 RUN useradd --system --uid 10001 --home-dir /app quickadd \
  && mkdir -p /app /data && chown quickadd /data