|
Lines 229-269
Merges parameters from $q_params into $filtered_params.
Link Here
|
| 229 |
|
229 |
|
| 230 |
=head3 stash_embed |
230 |
=head3 stash_embed |
| 231 |
|
231 |
|
| 232 |
$c->stash_embed( $c->match->endpoint->pattern->defaults->{'openapi.op_spec'} ); |
232 |
$c->stash_embed( ); |
| 233 |
|
233 |
|
| 234 |
=cut |
234 |
=cut |
| 235 |
|
235 |
|
| 236 |
$app->helper( |
236 |
$app->helper( |
| 237 |
'stash_embed' => sub { |
237 |
'stash_embed' => sub { |
| 238 |
|
238 |
|
| 239 |
my ( $c, $args ) = @_; |
239 |
my ( $c ) = @_; |
| 240 |
|
|
|
| 241 |
my $spec = $args->{spec} // {}; |
| 242 |
|
240 |
|
| 243 |
my $embed_spec; |
241 |
# FIXME: This routine is currently called from Auth, and only Auth, |
| 244 |
for my $param (@{$spec->{parameters}}) { |
242 |
# and is prior to OpenAPI validation. As such, we cannot use the |
| 245 |
next unless $param->{name} eq 'x-koha-embed'; |
243 |
# validated output of OpenAPI yet and thus have to fetch and split |
| 246 |
$embed_spec = $param->{items}->{enum}; |
244 |
# the headers ourselves. Validation takes place as the first step in |
| 247 |
} |
245 |
# the controllers and will varify the header again at this point. |
| 248 |
my $embed_header = $c->req->headers->header('x-koha-embed'); |
246 |
my $embed_header = $c->req->headers->header('x-koha-embed'); |
| 249 |
|
247 |
if ($embed_header) { |
| 250 |
Koha::Exceptions::BadParameter->throw("Embedding objects is not allowed on this endpoint.") |
|
|
| 251 |
if $embed_header and !defined $embed_spec; |
| 252 |
|
| 253 |
if ( $embed_header ) { |
| 254 |
my $THE_embed = {}; |
248 |
my $THE_embed = {}; |
| 255 |
foreach my $embed_req ( split /\s*,\s*/, $embed_header ) { |
249 |
foreach my $embed_req ( split /\s*,\s*/, $embed_header ) { |
| 256 |
my $matches = grep {lc $_ eq lc $embed_req} @{ $embed_spec }; |
250 |
_merge_embed( _parse_embed($embed_req), $THE_embed ); |
| 257 |
|
|
|
| 258 |
Koha::Exceptions::BadParameter->throw( |
| 259 |
error => 'Embeding '.$embed_req. ' is not authorised. Check your x-koha-embed headers or remove it.' |
| 260 |
) unless $matches; |
| 261 |
|
| 262 |
_merge_embed( _parse_embed($embed_req), $THE_embed); |
| 263 |
} |
251 |
} |
| 264 |
|
252 |
|
| 265 |
$c->stash( 'koha.embed' => $THE_embed ) |
253 |
$c->stash( 'koha.embed' => $THE_embed ) |
| 266 |
if $THE_embed; |
254 |
if $THE_embed; |
| 267 |
} |
255 |
} |
| 268 |
|
256 |
|
| 269 |
return $c; |
257 |
return $c; |