View | Details | Raw Unified | Return to bug 28907
Collapse All | Expand All

(-)a/Koha/REST/Plugin/Auth/PublicRoutes.pm (+119 lines)
Line 0 Link Here
1
package Koha::REST::Plugin::Auth::PublicRoutes;
2
3
# Copyright Hypernova Oy 2024
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
22
use Mojo::Base 'Mojolicious::Plugin';
23
24
use Koha::Exception;
25
use Koha::Exceptions;
26
use Koha::Exceptions::REST;
27
use Koha::Patrons;
28
29
use Module::Load::Conditional;
30
31
=head1 NAME
32
33
Koha::REST::Plugin::Auth::PublicRoutes
34
35
=head1 API
36
37
=head2 Mojolicious::Plugin methods
38
39
=head3 register
40
41
=cut
42
43
sub register {
44
    my ( $self, $app ) = @_;
45
46
=head2 Helper methods
47
48
=head3 auth.public
49
50
    $c->auth->public( $public_user_id );
51
52
=cut
53
54
    $app->helper(
55
        'auth.public' => sub {
56
            my ( $c, $public_user_id ) = @_;
57
58
            unless ( $c->stash('is_public') ) {
59
                Koha::Exception->throw( error => "This is not a public route!" );
60
            }
61
62
            my $user = $c->stash('koha.user');
63
64
            unless ($user) {
65
                Koha::Exceptions::REST::Public::Authentication::Required->throw( error => "Authentication failure." );
66
            }
67
68
            unless ($public_user_id) {
69
                Koha::Exceptions::REST::Public::Unauthorized->throw(
70
                    error => "Unprivileged user cannot access another user's resources" );
71
            }
72
73
            if ( $user->borrowernumber == $public_user_id ) {
74
                return 1;
75
            } else {
76
                Koha::Exceptions::REST::Public::Unauthorized->throw(
77
                    error => "Unprivileged user cannot access another user's resources" );
78
            }
79
        }
80
    );
81
82
=head3 auth.public_guarantor
83
84
    $c->auth->public_guarantor( $public_user_id );
85
86
=cut
87
88
    $app->helper(
89
        'auth.public_guarantor' => sub {
90
            my ( $c, $public_user_id ) = @_;
91
92
            unless ( $c->stash('is_public') ) {
93
                Koha::Exception->throw( error => "This is not a public route!" );
94
            }
95
96
            my $user = $c->stash('koha.user');
97
98
            unless ($user) {
99
                Koha::Exceptions::REST::Public::Authentication::Required->throw( error => "Authentication failure." );
100
            }
101
102
            unless ($public_user_id) {
103
                Koha::Exceptions::REST::Public::Unauthorized->throw(
104
                    error => "Unprivileged user cannot access another user's resources" );
105
            }
106
107
            my $guarantees = $user->guarantee_relationships->guarantees->as_list;
108
            foreach my $guarantee ( @{$guarantees} ) {
109
                if ( $guarantee->borrowernumber == $public_user_id ) {
110
                    return 1;
111
                }
112
            }
113
            Koha::Exceptions::REST::Public::Unauthorized->throw(
114
                error => "Unprivileged user cannot access another user's resources" );
115
        }
116
    );
117
}
118
119
1;
(-)a/Koha/REST/V1.pm (+1 lines)
Lines 159-164 sub startup { Link Here
159
    $self->plugin('Koha::REST::Plugin::Exceptions');
159
    $self->plugin('Koha::REST::Plugin::Exceptions');
160
    $self->plugin('Koha::REST::Plugin::Responses');
160
    $self->plugin('Koha::REST::Plugin::Responses');
161
    $self->plugin('Koha::REST::Plugin::Auth::IdP');
161
    $self->plugin('Koha::REST::Plugin::Auth::IdP');
162
    $self->plugin('Koha::REST::Plugin::Auth::PublicRoutes');
162
    $self->plugin( 'Mojolicious::Plugin::OAuth2' => $oauth_configuration );
163
    $self->plugin( 'Mojolicious::Plugin::OAuth2' => $oauth_configuration );
163
}
164
}
164
165
(-)a/t/db_dependent/Koha/REST/Plugin/Auth/PublicRoutes.t (-1 / +145 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/perl
2
3
# Copyright 2024 Hypernova Oy
4
#
5
# This file is part of Koha
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
22
use Koha::Patrons;
23
use Try::Tiny;
24
25
# Dummy app for testing the plugin
26
use Mojolicious::Lite;
27
28
plugin 'Koha::REST::Plugin::Auth::PublicRoutes';
29
30
post '/public' => sub {
31
    my $c      = shift;
32
    my $params = $c->req->json;
33
34
    $c->stash( 'koha.user' => Koha::Patrons->find( $params->{'user'} ) );
35
    $c->stash( 'is_public' => 1 );
36
37
    try {
38
        my $patron_id = $params->{'patron_id'};
39
        $c->auth->public($patron_id);
40
        $c->render( status => 200, json => "OK" );
41
    } catch {
42
        if ( ref($_) eq 'Koha::Exceptions::REST::Public::Authentication::Required' ) {
43
            $c->render( status => 401, json => { message => 'authentication_required' } );
44
        } elsif ( ref($_) eq 'Koha::Exceptions::REST::Public::Unauthorized' ) {
45
            $c->render( status => 403, json => { message => 'unauthorized' } );
46
        } else {
47
            $c->render( status => 500, json => { message => 'other error' } );
48
        }
49
    }
50
};
51
52
post '/public_guarantor' => sub {
53
    my $c      = shift;
54
    my $params = $c->req->json;
55
56
    $c->stash( 'koha.user' => Koha::Patrons->find( $params->{'user'} ) );
57
    $c->stash( 'is_public' => 1 );
58
59
    try {
60
        my $patron_id = $params->{'patron_id'};
61
        $c->auth->public_guarantor($patron_id);
62
        $c->render( status => 200, json => "OK" );
63
    } catch {
64
        if ( ref($_) eq 'Koha::Exceptions::REST::Public::Authentication::Required' ) {
65
            $c->render( status => 401, json => { message => 'authentication_required' } );
66
        } elsif ( ref($_) eq 'Koha::Exceptions::REST::Public::Unauthorized' ) {
67
            $c->render( status => 403, json => { message => 'unauthorized' } );
68
        } else {
69
            $c->render( status => 500, json => { message => 'other error' } );
70
        }
71
    }
72
};
73
74
use Test::More tests => 2;
75
use Test::Mojo;
76
77
use t::lib::Mocks;
78
use t::lib::TestBuilder;
79
use Koha::Database;
80
81
my $schema  = Koha::Database->new()->schema();
82
my $builder = t::lib::TestBuilder->new;
83
84
# FIXME: sessionStorage defaults to mysql, but it seems to break transaction handling
85
# this affects the other REST api tests
86
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
87
88
subtest 'auth.public helper' => sub {
89
    plan tests => 9;
90
91
    $schema->storage->txn_begin;
92
93
    my $unprivileged_patron = $builder->build_object( { class => 'Koha::Patrons' } );
94
    my $another_patron      = $builder->build_object( { class => 'Koha::Patrons' } );
95
96
    my $t = Test::Mojo->new;
97
98
    $t->post_ok( '/public' => json => { patron_id => $another_patron->borrowernumber } )->status_is(401)
99
        ->json_is( { message => 'authentication_required' } );
100
101
    $t->post_ok( '/public' => json =>
102
            { user => $unprivileged_patron->borrowernumber, patron_id => $another_patron->borrowernumber } )
103
        ->status_is(403)->json_is( { message => 'unauthorized' } );
104
105
    $t->post_ok( '/public' => json =>
106
            { user => $unprivileged_patron->borrowernumber, patron_id => $unprivileged_patron->borrowernumber } )
107
        ->status_is(200)->json_is('OK');
108
109
    $schema->storage->txn_rollback;
110
};
111
112
subtest 'auth.public_guarantor helper' => sub {
113
    plan tests => 12;
114
115
    $schema->storage->txn_begin;
116
117
    t::lib::Mocks::mock_preference( 'borrowerRelationship', 'test' );
118
119
    my $guarantee = $builder->build_object( { class => 'Koha::Patrons' } );
120
    my $guarantor = $builder->build_object( { class => 'Koha::Patrons' } );
121
    $guarantee->add_guarantor( { guarantor_id => $guarantor->borrowernumber, relationship => 'test' } );
122
    my $another_patron = $builder->build_object( { class => 'Koha::Patrons' } );
123
124
    my $t = Test::Mojo->new;
125
126
    $t->post_ok( '/public_guarantor' => json => { patron_id => $another_patron->borrowernumber } )->status_is(401)
127
        ->json_is( { message => 'authentication_required' } );
128
129
    $t->post_ok( '/public_guarantor' => json =>
130
            { user => $guarantor->borrowernumber, patron_id => $another_patron->borrowernumber } )->status_is(403)
131
        ->json_is( { message => 'unauthorized' } );
132
133
    # user is not a guarantor of themself
134
    $t->post_ok(
135
        '/public_guarantor' => json => { user => $guarantor->borrowernumber, patron_id => $guarantor->borrowernumber } )
136
        ->status_is(403)->json_is( { message => 'unauthorized' } );
137
138
    $t->post_ok(
139
        '/public_guarantor' => json => { user => $guarantor->borrowernumber, patron_id => $guarantee->borrowernumber } )
140
        ->status_is(200)->json_is('OK');
141
142
    $schema->storage->txn_rollback;
143
};
144
145
1;

Return to bug 28907