Robin Goodall · Robin Goodall · Robin Goodall · Robin Goodall · Andrew Vella · Andrew Vella
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -31,3 +31,17 @@ pypi-release:
  needs: ["build"]
  variables:
    DIST_LOCATION: "/dist"
+
+latest-spec:
+  image: python:3.10
+  stage: test
+  script:
+    - pip install -r ./scripts/requirements.txt
+    - ./pull-specs.sh --token ${GITLAB_PULL_SPECS_TOKEN}
+    - git diff --exit-code
+  rules:
+    # Don't create a detached job on a merge request - a separate pipeline
+    # should be created for a branch which is where we expect this to be run
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      when: never
+    - when: always
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## [1.0.14] - 2022-10-13
+
+### Added
+- Clarified CARD_REQUEST_CREATOR permissions as applied to the Card API /update endpoint.
+- Added /all-photos endpoint to the Photo API.
+
+### Fixed
+- Allow HR API to return nullable start and end dates.
+
 ## [1.0.13] - 2022-09-28

 ### Added

--- a/setup.py
+++ b/setup.py
@@ -8,7 +8,7 @@ PACKAGE_DESCRIPTION = (
    "A module containing helpers and shared code related to identity systems within UIS, "
    "University of Cambridge."
 )
-PACKAGE_VERSION = "1.0.13"
+PACKAGE_VERSION = "1.0.14"
 PACKAGE_URL = "https://gitlab.developers.cam.ac.uk/uis/devops/iam/identity-lib"



--- a/specs/card.sha
+++ b/specs/card.sha
-c3c9d005cbdb7e60f143ec3f253abb87b3af67c1
\ No newline at end of file
+3e6c8e094143f39f64020bd897122b32e3028227
\ No newline at end of file
--- a/specs/card.yaml
+++ b/specs/card.yaml
@@ -1522,6 +1522,8 @@ paths:

        Principals with the `CARD_REQUEST_UPDATER` permission will be able to affect this endpoint.

+        Principals with the `CARD_REQUEST_CREATOR` permission are able to affect the `update`, `set_hold`, `release_hold` and `cancel` actions for card requests created by the principal.
+
      parameters:
        - name: data
          in: body

--- a/specs/hr.sha
+++ b/specs/hr.sha
-9e543ca652ef93c282084340bee24239394442c1
\ No newline at end of file
+2e8054979842e12a40ebcd1caa82e5e1455e9fc1
\ No newline at end of file
--- a/specs/hr.yaml
+++ b/specs/hr.yaml
@@ -44,8 +44,7 @@ paths:
      tags:
        - Staff members
      summary: List staff members
-      description: |2+
-
+      description: |-
        Lists all staff members held within the University Human Resources system, allowing basic
        filtering by affiliation.

@@ -58,7 +57,6 @@ paths:

        Staff members can be filtered by affiliation, by providing an `affiliation` query
        parameter. This affiliation should be provided in the format `<value>@<scheme>`.
-
      operationId: list_v1alpha2_staff_staff_get
      parameters:
        - description: An affiliation to filter by, in the format `<value>@<scheme>`. When included only the staff members with a matching affiliation are returned.
@@ -112,15 +110,13 @@ paths:
      tags:
        - Staff members
      summary: Get a single staff member
-      description: |2+
-
+      description: |-
        Returns a single staff member based on the identifier provided. The identifier can be
        provided in the format `<value>@<scheme>`, if the scheme is omitted it shall be
        assumed that the scheme is `person.v1.human-resources.university.identifiers.cam.ac.uk` (also know as the staff number or HRN).

        Currently this endpoint only supports querying by `person.v1.human-resources.university.identifiers.cam.ac.uk` and `v1.person.identifiers.cam.ac.uk`
        identifiers.
-
      operationId: get_v1alpha2_staff_member_staff__identifier__get
      parameters:
        - required: true
@@ -180,11 +176,13 @@ components:
          type: string
          description: The start date of this affiliation. May not be populated if not known.
          format: date
+          nullable: true
        end:
          title: End
          type: string
          description: The end date of this affiliation. May not be populated if the affiliation is open-ended.
          format: date
+          nullable: true
      description: |-
        A representation of an affiliation - indicating what type of affiliation this is
        and the entity which the affiliation is related to. Also contains a `status`

--- a/specs/photo.sha
+++ b/specs/photo.sha
-0aafe76d2166c6fc0029a26852a3c4a405829939
\ No newline at end of file
+4bc2c4d1d6bcfc61a9320e7b048c39b20c10657e
\ No newline at end of file
--- a/specs/photo.yaml
+++ b/specs/photo.yaml
@@ -128,10 +128,12 @@ components:
          type: array
        imageHeight:
          description: The height of the image
+          nullable: true
          readOnly: true
          type: integer
        imageWidth:
          description: The width of the image
+          nullable: true
          readOnly: true
          type: integer
        invalidatedAt:
@@ -373,6 +375,101 @@ paths:
      summary: List permissions
      tags:
        - Permissions
+  /v1beta1/all-photos:
+    get:
+      description: |2+
+
+        # List all Photos
+
+        This endpoint allows information and metadata about all Photos to be fetched.
+
+        Results are ordered by `createdAt` ascending, and may be split over multiple 'pages'.
+        Where more results exist a `next` URL will be provided which can be used to fetch the next page
+        of results. The `previous` URL can be used to navigate backwards through the result pages. The
+        `pageSize` query parameter can be used to request a specific amount of results per page.
+        If not provided the `pageSize` is set to `200`. The amount of results per page is limited to
+        `500`, if a number greater than `500` is specified in the `pageSize` parameter no error is
+        returned but the number of results will be capped at 500 per page.
+
+        Only principals with the `PHOTO_ADMIN` permission can list all photos.
+
+      operationId: v1beta1_all_photos_list
+      parameters:
+        - description: The pagination cursor value.
+          in: query
+          name: cursor
+          required: false
+          schema:
+            type: string
+        - description: Number of results to return per page.
+          in: query
+          name: pageSize
+          required: false
+          schema:
+            type: integer
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PaginatedV1Beta1PhotoList'
+          description: Success
+        "400":
+          content:
+            application/json:
+              examples:
+                InvalidRequest:
+                  description: A response indicating that the request could not be processed because it is invalid or malformed
+                  summary: Invalid Request
+                  value:
+                    detail: Malformed request.
+              schema:
+                $ref: '#/components/schemas/BadRequest'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              examples:
+                Unauthorized:
+                  description: A response indicating that the request could not be processed because the requester is not authorized to make the request.
+                  value:
+                    detail: Unauthorized request.
+              schema:
+                $ref: '#/components/schemas/Unauthorized'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              examples:
+                Forbidden:
+                  description: A response indicating that the request could not be processed because the requester does not have the permissions required to make the request.
+                  value:
+                    detail: Forbidden
+              schema:
+                $ref: '#/components/schemas/Forbidden'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              examples:
+                ServerError:
+                  description: A response indicating that the request could not be processed because of an internal server error.
+                  summary: Server Error
+                  value:
+                    detail: Server error.
+              schema:
+                $ref: '#/components/schemas/InternalServerError'
+          description: Internal Server Error
+      security:
+        - apiGatewayAuthorizationCodeSecurityScheme:
+            - https://api.apps.cam.ac.uk/photo/photos
+            - https://api.apps.cam.ac.uk/photo/photos.readonly
+        - apiGatewayClientCredentialsSecurityScheme:
+            - https://api.apps.cam.ac.uk/photo/photos
+            - https://api.apps.cam.ac.uk/photo/photos.readonly
+      summary: List all photos
+      tags:
+        - All Photos
  /v1beta1/approved-photos:
    get:
      description: |2+
@@ -1520,7 +1617,7 @@ paths:
          name: identifiers
          schema:
            type: string
-        - description: If set to true, postpone the reivew of this photo.
+        - description: If set to true, postpone the review of this photo.
          in: query
          name: postponeReview
          schema: