Lines 4-9
use Modern::Perl;
Link Here
|
4 |
use Mojo::Base 'Mojolicious'; |
4 |
use Mojo::Base 'Mojolicious'; |
5 |
use Mojo::Log; |
5 |
use Mojo::Log; |
6 |
|
6 |
|
|
|
7 |
use Digest::SHA qw(hmac_sha256_hex); |
8 |
|
9 |
use Koha::Borrower; |
10 |
use Koha::Borrowers; |
11 |
use Koha::ApiKey; |
12 |
use Koha::ApiKeys; |
13 |
use Koha::ApiTimestamp; |
14 |
use Koha::ApiTimestamps; |
15 |
|
16 |
|
7 |
=head startup |
17 |
=head startup |
8 |
|
18 |
|
9 |
Starts the Mojolicious application using whatever server is configured. |
19 |
Starts the Mojolicious application using whatever server is configured. |
Lines 71-79
sub startup {
Link Here
|
71 |
my $route = $self->routes->under->to( |
81 |
my $route = $self->routes->under->to( |
72 |
cb => sub { |
82 |
cb => sub { |
73 |
my $c = shift; |
83 |
my $c = shift; |
74 |
my $user = $c->param('user'); |
84 |
my $req_username = $c->req->headers->header('X-Koha-Username'); |
75 |
# Do the authentication stuff here... |
85 |
my $req_timestamp = $c->req->headers->header('X-Koha-Timestamp'); |
76 |
$c->stash('user', $user); |
86 |
my $req_signature = $c->req->headers->header('X-Koha-Signature'); |
|
|
87 |
my $req_method = $c->req->method; |
88 |
my $req_url = '/' . $c->req->url->path_query; |
89 |
|
90 |
# "Anonymous" mode |
91 |
return 1 |
92 |
unless ( defined($req_username) |
93 |
or defined($req_timestamp) |
94 |
or defined($req_signature) ); |
95 |
|
96 |
my $borrower = Koha::Borrowers->find({userid => $req_username}); |
97 |
|
98 |
my @apikeys = Koha::ApiKeys->search({ |
99 |
borrowernumber => $borrower->borrowernumber, |
100 |
active => 1, |
101 |
}); |
102 |
|
103 |
my $message = "$req_method $req_url $req_username $req_timestamp"; |
104 |
my $signature = ''; |
105 |
foreach my $apikey (@apikeys) { |
106 |
$signature = hmac_sha256_hex($message, $apikey->api_key); |
107 |
|
108 |
last if $signature eq $req_signature; |
109 |
} |
110 |
|
111 |
unless ($signature eq $req_signature) { |
112 |
$c->res->code(403); |
113 |
$c->render(json => { error => "Authentication failed" }); |
114 |
return; |
115 |
} |
116 |
|
117 |
my $api_timestamp = Koha::ApiTimestamps->find($borrower->borrowernumber); |
118 |
my $timestamp = $api_timestamp ? $api_timestamp->timestamp : 0; |
119 |
unless ($timestamp < $req_timestamp) { |
120 |
$c->res->code(403); |
121 |
$c->render(json => { error => "Bad timestamp" }); |
122 |
return; |
123 |
} |
124 |
|
125 |
unless ($api_timestamp) { |
126 |
$api_timestamp = new Koha::ApiTimestamp; |
127 |
$api_timestamp->borrowernumber($borrower->borrowernumber); |
128 |
} |
129 |
$api_timestamp->timestamp($req_timestamp); |
130 |
$api_timestamp->store; |
131 |
|
132 |
# Authentication succeeded, store authenticated user in stash |
133 |
$c->stash('user', $borrower); |
77 |
return 1; |
134 |
return 1; |
78 |
} |
135 |
} |
79 |
); |
136 |
); |