Remove duplicate request detection

Per MeLCat staff 2013-07-26, duplicate request detection is no
longer needed, and can cause its own problems. It should be removed.

This commit removes the duplicate NCIP message detection.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Avoid referencing nonexistent AgencyId vars

In fail() and do_user_lookup_error_stanza(), we were attempting to
call staff_log() with values for FromAgencyId and ToAgencyId using
variables which did not exist.

Also, in fail() we were attempting to use those same variables in
the creation of an XML NCIP response.

The above issues would result in "Use of uninitialized value"
warnings, as well preventing use of "use strict".

This commit removes the references to the nonexistent variables,
resulting in the same log and xml output.

A future commit may provide a means for these functions to log the
FromAgencyId and ToAgencyId.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Fix ref. to nonexistent $visid, clarify terms

The XML for NCIP message RenewItemResponse was being constructed
with a nonexistent variable $visid, resulting in warnings and no
content in the ItemIdentifierValue element.

When processing a RenewItem message in renew_item(), we are
referencing the item by its UniqueItemId, so in addition to fixing
the nonexistent variable issue, this commit adjusts the variable
names for clarity.

Log output is also changed.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Fix nonexistent variables in ItemReceivedResponse

When creating an NCIP ItemReceivedResponse message, nonexistent
variables were being referenced, resulting in warnings and empty
values for the following elements in ResponseHeader:

FromAgencyId/UniqueAgencyId/Scheme
ToAgencyId/UniqueAgencyId/Scheme
ToAgencyId/UniqueAgencyId/Value

This commit populates the variables $faidScheme, $taidScheme, and
$taidValie in a manner similar to other locations in the code,
silencing the warnings and causing the elements in question to
contain data.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
use strict;

Having eliminated a number of issues with nonexistent variables being
referenced, we can now enable the "use strict" pragma.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Begin to break config out into ini file

Begin to migrate from hardcoded variables to a configuration file.

Copy the example iNCIPit.ini-example file to iNCIPit.ini and make
your changes there.

At this point, only the username and password are moved to a config
file.

This commit introduces a new dependency on Config::Tiny

SECURITY NOTE:
You will want to take steps to protect your configuration file, and
ensure that it is NOT accessible via the web server.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Add support for source IP auth behind a proxy

When using a proxy in front of your web server(s), the web server
sees the IP address of the proxy, and not the actual IP address of
the client making the requests.

This prevents you from using standard Apache directives to limit
access to a set of specific source IP addresses. While there are
Apache modules available that can help in this situation, we also
have the option of performing the access control within iNCIPit
itself.

This commit adds support for relying on the X-Forwarded-For HTTP
header to determine the actual IP of the client.

SECURITY NOTE: Your proxy MUST set/modify the X-Forwarded-For HTTP
header for this feature to work. If your proxy passes the header
unmodified, not only will your authorized clients likely be unable
to access the script, but unauthorized clients can easily spoof the
header to gain access.

To use, in the [access] section of iNCIPit.ini:

- set load_balancer_ip to the IP of your proxy
- set allowed_client_ips to a comma-delimited list of authorized IP
  addresses

If your proxy speaks to your backend servers via HTTP, you will also
need to set permit_plaintext to "yes" (case insensitive).  You must
then rely on your proxy to enforce the use of HTTPS, or trust your
authorized clients to always use HTTPS.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Whitespace cleanup.

Whitespace cleanup -- replace stray tabs.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Fix syntax error

Fix syntax error: ~= != =~

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Move more things into config file, add comments

Move more previously-hardcoded values to the config file, remove
CUSTOMIZATION NEEDED markers where appropriate, add a few NOTE and
TODO comments.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Handle "copy not found" scenario

Prevent internal server error condition when we receive an
AcceptItem message and the copy in question is not found.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Add option to skip item agency ItemRequested holds

Add configuration option under "behavior" ini section to disable
holds and copy status changes when we are the item agency receiving
an ItemRequested message.

Useful if you are not relying on Evergreen hold pull lists and just
want to use the paging slips from the DCB client to pull items to
ship to other agencies.

The default behavior remains the same, unless you set
"no_item_agency_holds = yes" under [behavior].

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Add option to omit patron email from LookupUser

Add option to omit the patron email address in a LookupUserResponse
message.

To omit patron email addresses, specify the following in the config
file:

[behavior]
omit_patron_email = yes

The default is to include patron email addresses in the
LookupUserResponse message.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Use profile name for AgencyUserPrivilegeType value

In the AgencyUserPrivilegeType value, we were returning a
stringified Perl object reference instead of something resembling a
string or integer.

Remove $userprivid (which did not contain the profile id anyway) and
instead return the profile name as the AgencyUserPrivilegeType
value.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Rename example configuration file

Rename the example configuration file, mostly for the benefit of it
having an .ini filename extension for things like syntax hilighting
editors.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Stop re-declaring $userpriv, remove unused $userou

Avoid a warning by not declaring $userpriv twice.

Remove $userou as we are not currently using it.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Add configurable mapping of patron profile names

Support mapping patron profile names to new values using a
"userpriv" file.

This is a re-implementation of a feature from MCLS / Jon Scott code
received via e-mail.

See userpriv-example for an example mapping file.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Fix call to lookup_userpriv to pass map also

In order to perform a successful userpriv lookup, we need to pass
lookup_userpriv the hashref to the populated map.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Remove unused functions originally from issa.pl

Remove unused functions originally copied from issa.pl (GPL v2 or
later).

- place_hold
- set_title_hold_expiration
- org_unit_from_shortname

If they are needed in the future, we know where to find them.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Add comments about CheckOutItem barcodes

Add comments about item barcode assumptions when responding in a
User Agency vs Item Agency CheckOutItem scenario.

Signed-off-by: Jeff Godin <jgodin@tadl.org>