From 5435cf3ebef5792a64f11f27fa7446c21a273438 Mon Sep 17 00:00:00 2001 From: Tomas Cohen Arazi Date: Mon, 23 Dec 2019 10:26:04 -0300 Subject: [PATCH] Bug 24302: Add a way to specify nested objects to embed in OpenAPI This patch introduces a helper for handling x-koha-embed headers on API requests. It reads the embed definitions and adds them to the stash for later use (either manually on the controllers, or in the objects.search helper. Submitting early for community scrutiny. --- Koha/REST/Plugin/Query.pm | 35 +++++++++++++++++++++++++++++++++++ Koha/REST/V1/Auth.pm | 3 +++ 2 files changed, 38 insertions(+) diff --git a/Koha/REST/Plugin/Query.pm b/Koha/REST/Plugin/Query.pm index 14b3f5997e..2b851e3d2a 100644 --- a/Koha/REST/Plugin/Query.pm +++ b/Koha/REST/Plugin/Query.pm @@ -143,6 +143,41 @@ is raised. return $params; } ); + +=head3 stash_embed + + $c->stash_embed( $c->match->endpoint->pattern->defaults->{'openapi.op_spec'} ); + +=cut + + $app->helper( + 'stash_embed' => sub { + + my ( $c, $spec ) = @_; + + my $embed_spec = $spec->{'x-koha-embed'}; + my $embed_header = $c->req->headers->header('x-koha-embed'); + + Koha::Exceptions::WrongParameter->throw("Embedding objects is not allowed on this endpoint") + if $embed_header and !defined $embed_spec; + + my @to_embed; + foreach my $embed_req ( split /\s*,\s*/, $embed_header ) { + my $matches = grep {lc $_ eq lc $embed_req} @{ $embed_req }; + + Koha::Exceptions::WrongParameter->throw( + error => 'Embeding '.$embed_req. ' is not authorised. Check your x-koha-embed headers or remove it.' + ) unless $matches; + + push @to_embed, $embed_req; + } + + $c->stash( 'koha.embed' => \@to_embed ) + if scalar @to_embed > 0; + + return $c; + } + ); } =head2 Internal methods diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm index 8bffc977da..94a2b81d93 100644 --- a/Koha/REST/V1/Auth.pm +++ b/Koha/REST/V1/Auth.pm @@ -137,6 +137,9 @@ sub authenticate_api_request { my $user; my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; + + $c->stash_embed( $spec ); + my $authorization = $spec->{'x-koha-authorization'}; my $authorization_header = $c->req->headers->authorization; -- 2.24.1