|
Lines 4-9
use Modern::Perl;
Link Here
|
| 4 |
use Mojo::Base 'Mojolicious'; |
4 |
use Mojo::Base 'Mojolicious'; |
| 5 |
use Mojo::Log; |
5 |
use Mojo::Log; |
| 6 |
|
6 |
|
|
|
7 |
use Digest::SHA qw(hmac_sha256_hex); |
| 8 |
|
| 9 |
use Koha::Borrower; |
| 10 |
use Koha::Borrowers; |
| 11 |
use Koha::ApiKey; |
| 12 |
use Koha::ApiKeys; |
| 13 |
use Koha::ApiTimestamp; |
| 14 |
use Koha::ApiTimestamps; |
| 15 |
|
| 16 |
|
| 7 |
=head startup |
17 |
=head startup |
| 8 |
|
18 |
|
| 9 |
Starts the Mojolicious application using whatever server is configured. |
19 |
Starts the Mojolicious application using whatever server is configured. |
|
Lines 71-79
sub startup {
Link Here
|
| 71 |
my $route = $self->routes->under->to( |
81 |
my $route = $self->routes->under->to( |
| 72 |
cb => sub { |
82 |
cb => sub { |
| 73 |
my $c = shift; |
83 |
my $c = shift; |
| 74 |
my $user = $c->param('user'); |
84 |
my $req_username = $c->req->headers->header('X-Koha-Username'); |
| 75 |
# Do the authentication stuff here... |
85 |
my $req_timestamp = $c->req->headers->header('X-Koha-Timestamp'); |
| 76 |
$c->stash('user', $user); |
86 |
my $req_signature = $c->req->headers->header('X-Koha-Signature'); |
|
|
87 |
my $req_method = $c->req->method; |
| 88 |
my $req_url = '/' . $c->req->url->path_query; |
| 89 |
|
| 90 |
# "Anonymous" mode |
| 91 |
return 1 |
| 92 |
unless ( defined($req_username) |
| 93 |
or defined($req_timestamp) |
| 94 |
or defined($req_signature) ); |
| 95 |
|
| 96 |
my $borrower = Koha::Borrowers->find({userid => $req_username}); |
| 97 |
|
| 98 |
my @apikeys = Koha::ApiKeys->search({ |
| 99 |
borrowernumber => $borrower->borrowernumber, |
| 100 |
active => 1, |
| 101 |
}); |
| 102 |
|
| 103 |
my $message = "$req_method $req_url $req_username $req_timestamp"; |
| 104 |
my $signature = ''; |
| 105 |
foreach my $apikey (@apikeys) { |
| 106 |
$signature = hmac_sha256_hex($message, $apikey->api_key); |
| 107 |
|
| 108 |
last if $signature eq $req_signature; |
| 109 |
} |
| 110 |
|
| 111 |
unless ($signature eq $req_signature) { |
| 112 |
$c->res->code(403); |
| 113 |
$c->render(json => { error => "Authentication failed" }); |
| 114 |
return; |
| 115 |
} |
| 116 |
|
| 117 |
my $api_timestamp = Koha::ApiTimestamps->find($borrower->borrowernumber); |
| 118 |
my $timestamp = $api_timestamp ? $api_timestamp->timestamp : 0; |
| 119 |
unless ($timestamp < $req_timestamp) { |
| 120 |
$c->res->code(403); |
| 121 |
$c->render(json => { error => "Bad timestamp" }); |
| 122 |
return; |
| 123 |
} |
| 124 |
|
| 125 |
unless ($api_timestamp) { |
| 126 |
$api_timestamp = new Koha::ApiTimestamp; |
| 127 |
$api_timestamp->borrowernumber($borrower->borrowernumber); |
| 128 |
} |
| 129 |
$api_timestamp->timestamp($req_timestamp); |
| 130 |
$api_timestamp->store; |
| 131 |
|
| 132 |
# Authentication succeeded, store authenticated user in stash |
| 133 |
$c->stash('user', $borrower); |
| 77 |
return 1; |
134 |
return 1; |
| 78 |
} |
135 |
} |
| 79 |
); |
136 |
); |