|
Lines 91-111
sub authenticate_api_request {
Link Here
|
| 91 |
) if $cookie and $action_spec->{'x-koha-authorization'}; |
91 |
) if $cookie and $action_spec->{'x-koha-authorization'}; |
| 92 |
} |
92 |
} |
| 93 |
|
93 |
|
| 94 |
my @errors = validate_parameters( $c, $action_spec ); |
|
|
| 95 |
return $c->render_swagger({}, \@errors, 400) if @errors; |
| 96 |
|
94 |
|
| 97 |
return $next->($c) unless $action_spec->{'x-koha-authorization'}; |
95 |
# Then check the parameters |
|
|
96 |
my @query_errors = validate_query_parameters( $c, $action_spec ); |
| 97 |
|
| 98 |
# We do not need any authorization |
| 99 |
unless ( $action_spec->{'x-koha-authorization'} ) { |
| 100 |
return @query_errors |
| 101 |
? $c->render_swagger({}, \@query_errors, 400) |
| 102 |
: $next->($c); |
| 103 |
} |
| 104 |
|
| 98 |
unless ($user) { |
105 |
unless ($user) { |
| 99 |
return $c->render_swagger({ error => "Authentication required." },{},401); |
106 |
return $c->render_swagger({ error => "Authentication required." },{},401); |
| 100 |
} |
107 |
} |
| 101 |
|
108 |
|
| 102 |
my $authorization = $action_spec->{'x-koha-authorization'}; |
109 |
my $authorization = $action_spec->{'x-koha-authorization'}; |
| 103 |
my $permissions = $authorization->{'permissions'}; |
110 |
my $permissions = $authorization->{'permissions'}; |
|
|
111 |
|
| 112 |
# Check if the user is authorized |
| 104 |
if ( C4::Auth::haspermission($user->userid, $permissions) |
113 |
if ( C4::Auth::haspermission($user->userid, $permissions) |
| 105 |
or allow_owner($c, $authorization, $user) |
114 |
or allow_owner($c, $authorization, $user) |
| 106 |
or allow_guarantor($c, $authorization, $user) ) { |
115 |
or allow_guarantor($c, $authorization, $user) ) { |
|
|
116 |
|
| 117 |
# Return the query errors if exist |
| 118 |
return $c->render_swagger({}, \@query_errors, 400) if @query_errors; |
| 119 |
|
| 120 |
# Everything is ok |
| 107 |
return $next->($c) |
121 |
return $next->($c) |
| 108 |
} |
122 |
} |
|
|
123 |
|
| 109 |
return $c->render_swagger( |
124 |
return $c->render_swagger( |
| 110 |
{ error => "Authorization failure. Missing required permission(s).", |
125 |
{ error => "Authorization failure. Missing required permission(s).", |
| 111 |
required_permissions => $permissions }, |
126 |
required_permissions => $permissions }, |
|
Lines 114-120
sub authenticate_api_request {
Link Here
|
| 114 |
); |
129 |
); |
| 115 |
} |
130 |
} |
| 116 |
|
131 |
|
| 117 |
sub validate_parameters { |
132 |
sub validate_query_parameters { |
| 118 |
my ( $c, $action_spec ) = @_; |
133 |
my ( $c, $action_spec ) = @_; |
| 119 |
|
134 |
|
| 120 |
# Check for malformed query parameters |
135 |
# Check for malformed query parameters |
| 121 |
- |
|
|