Attachment #137331 for bug #28787

View | Details | Raw Unified | Return to bug 28787
Collapse All | Expand All




        my ($status, $session) = check_cookie_auth(
                                                $cookie, undef,
                                                { remote_addr => $remote_addr });

        if ( $c->req->url->to_abs->path eq '/api/v1/auth/otp/token_delivery' ) {
            if ( $status eq 'additional-auth-needed' ) {
                $user        = Koha::Patrons->find( $session->param('number') );
                $cookie_auth = 1;
            }
            elsif ( $status eq 'ok' ) {
                Koha::Exceptions::Authentication->throw(
                    error => 'Cannot request a new token.' );
            }
            else {
                Koha::Exceptions::Authentication::Required->throw(
                    error => 'Authentication failure.' );
            }
        } else {
            if ($status eq "ok") {
                $user = Koha::Patrons->find( $session->param('number') );
                $cookie_auth = 1;
            }
            elsif ($status eq "anon") {
                $cookie_auth = 1;
            }
            elsif ($status eq "additional-auth-needed") {
            }
            elsif ($status eq "maintenance") {
                Koha::Exceptions::UnderMaintenance->throw(
                    error => 'System is under maintenance.'
                );
            }
            elsif ($status eq "expired" and $authorization) {
                Koha::Exceptions::Authentication::SessionExpired->throw(
                    error => 'Session has been expired.'
                );
            }
            elsif ($status eq "failed" and $authorization) {
                Koha::Exceptions::Authentication::Required->throw(
                    error => 'Authentication failure.'
                );
            }
            elsif ($authorization) {
                Koha::Exceptions::Authentication->throw(
                    error => 'Unexpected authentication status.'
                );
            }
        }
        elsif ($status eq "expired" and $authorization) {
            Koha::Exceptions::Authentication::SessionExpired->throw(
                error => 'Session has been expired.'
            );
        }
        elsif ($status eq "failed" and $authorization) {
            Koha::Exceptions::Authentication::Required->throw(
                error => 'Authentication failure.'
            );
        }
        elsif ($authorization) {
            Koha::Exceptions::Authentication->throw(
                error => 'Unexpected authentication status.'
            );
        }
    }






subtest 'send_otp_token' => sub {

    plan tests => 9;

    $schema->storage->txn_begin;


    $tx->req->env( { REMOTE_ADDR => $remote_address } );

    # Patron is not authenticated yet
    $t->request_ok($tx)->status_is(401);

    $session->param('waiting-for-2FA', 1);
    $session->flush;

    # Everything is ok, the email will be sent
    $t->request_ok($tx)->status_is(200);

    $session->param('waiting-for-2FA', 0);
    $session->flush;
    $tx = $t->ua->build_tx( POST => "/api/v1/auth/otp/token_delivery" );
    $tx->req->cookies( { name => 'CGISESSID', value => $session->id } );
    $tx->req->env( { REMOTE_ADDR => $remote_address } );

    $t->request_ok($tx)->status_is(401);

    $schema->storage->txn_rollback;
};

- 

Return to bug 28787

Lines 223-264 sub authenticate_api_request { Link Here

(-)a/Koha/REST/V1/Auth.pm (-30 / +38 lines)
223	my ($status, $session) = check_cookie_auth(	223	my ($status, $session) = check_cookie_auth(
224	$cookie, undef,	224	$cookie, undef,
225	{ remote_addr => $remote_addr });	225	{ remote_addr => $remote_addr });
226	if ($status eq "ok") {	226
227	$user = Koha::Patrons->find( $session->param('number') );	227	if ( $c->req->url->to_abs->path eq '/api/v1/auth/otp/token_delivery' ) {
228	$cookie_auth = 1;	228	if ( $status eq 'additional-auth-needed' ) {
229	}	229	$user = Koha::Patrons->find( $session->param('number') );
230	elsif ($status eq "anon") {	230	$cookie_auth = 1;
231	$cookie_auth = 1;	231	}
232	}	232	elsif ( $status eq 'ok' ) {
233	elsif ($status eq "additional-auth-needed") {	233	Koha::Exceptions::Authentication->throw(
234	if ( $c->req->url->to_abs->path eq '/api/v1/auth/otp/token_delivery' ) {	234	error => 'Cannot request a new token.' );
		235	}
		236	else {
		237	Koha::Exceptions::Authentication::Required->throw(
		238	error => 'Authentication failure.' );
		239	}
		240	} else {
		241	if ($status eq "ok") {
235	$user = Koha::Patrons->find( $session->param('number') );	242	$user = Koha::Patrons->find( $session->param('number') );
236	$cookie_auth = 1;	243	$cookie_auth = 1;
237	} else {	244	}
		245	elsif ($status eq "anon") {
		246	$cookie_auth = 1;
		247	}
		248	elsif ($status eq "additional-auth-needed") {
		249	}
		250	elsif ($status eq "maintenance") {
		251	Koha::Exceptions::UnderMaintenance->throw(
		252	error => 'System is under maintenance.'
		253	);
		254	}
		255	elsif ($status eq "expired" and $authorization) {
		256	Koha::Exceptions::Authentication::SessionExpired->throw(
		257	error => 'Session has been expired.'
		258	);
		259	}
		260	elsif ($status eq "failed" and $authorization) {
238	Koha::Exceptions::Authentication::Required->throw(	261	Koha::Exceptions::Authentication::Required->throw(
239	error => 'Authentication failure.'	262	error => 'Authentication failure.'
240	);	263	);
241	}	264	}
242	}	265	elsif ($authorization) {
243	elsif ($status eq "maintenance") {	266	Koha::Exceptions::Authentication->throw(
244	Koha::Exceptions::UnderMaintenance->throw(	267	error => 'Unexpected authentication status.'
245	error => 'System is under maintenance.'	268	);
246	);	269	}
247	}
248	elsif ($status eq "expired" and $authorization) {
249	Koha::Exceptions::Authentication::SessionExpired->throw(
250	error => 'Session has been expired.'
251	);
252	}
253	elsif ($status eq "failed" and $authorization) {
254	Koha::Exceptions::Authentication::Required->throw(
255	error => 'Authentication failure.'
256	);
257	}
258	elsif ($authorization) {
259	Koha::Exceptions::Authentication->throw(
260	error => 'Unexpected authentication status.'
261	);
262	}	270	}
263	}	271	}
264		272

Lines 38-44 my $t = Test::Mojo->new('Koha::REST::V1'); Link Here

(-)a/t/db_dependent/api/v1/two_factor_auth.t (-3 / +10 lines)
38		38
39	subtest 'send_otp_token' => sub {	39	subtest 'send_otp_token' => sub {
40		40
41	plan tests => 7;	41	plan tests => 9;
42		42
43	$schema->storage->txn_begin;	43	$schema->storage->txn_begin;
44		44
Lines 63-69 subtest 'send_otp_token' => sub { Link Here
63	$tx->req->env( { REMOTE_ADDR => $remote_address } );	63	$tx->req->env( { REMOTE_ADDR => $remote_address } );
64		64
65	# Patron is not authenticated yet	65	# Patron is not authenticated yet
66	$t->request_ok($tx)->status_is(500); # FIXME Check the exception instead?	66	$t->request_ok($tx)->status_is(401);
67		67
68	$session->param('waiting-for-2FA', 1);	68	$session->param('waiting-for-2FA', 1);
69	$session->flush;	69	$session->flush;
Lines 100-105 subtest 'send_otp_token' => sub { Link Here
100	# Everything is ok, the email will be sent	100	# Everything is ok, the email will be sent
101	$t->request_ok($tx)->status_is(200);	101	$t->request_ok($tx)->status_is(200);
102		102
		103	$session->param('waiting-for-2FA', 0);
		104	$session->flush;
		105	$tx = $t->ua->build_tx( POST => "/api/v1/auth/otp/token_delivery" );
		106	$tx->req->cookies( { name => 'CGISESSID', value => $session->id } );
		107	$tx->req->env( { REMOTE_ADDR => $remote_address } );
		108
		109	$t->request_ok($tx)->status_is(401);
		110
103	$schema->storage->txn_rollback;	111	$schema->storage->txn_rollback;
104	};	112	};
105		113
106	-