Attachment #63188 for bug #18137

View | Details | Raw Unified | Return to bug 18137
Collapse All | Expand All




# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

use Modern::Perl;

use Mojo::Base 'Mojolicious';

use C4::Auth qw( check_cookie_auth get_session haspermission );
use C4::Context;
use Koha::Account::Lines;
use Koha::Checkouts;
use Koha::Holds;
use Koha::Old::Checkouts;
use Koha::Patrons;

=head1 NAME


        $self->secrets([$secret_passphrase]);
    }

    $self->plugin(OpenAPI => {
        url => $self->home->rel_file("api/v1/swagger/swagger.json"),
        route => $self->routes->under('/api/v1')->to('Auth#under'),
        allow_invalid_ref => 1, # required by our spec because $ref directly under
                                # Paths-, Parameters-, Definitions- & Info-object
                                # is not allowed by the OpenAPI specification.
    });
}

=head3 authenticate_api_request

Validates authentication and allows access if authorization is not required or
if authorization is required and user has required permissions to access.

This subroutine is called before every request to API.

=cut

sub authenticate_api_request {
    my ($next, $c, $action_spec) = @_;

    my ($session, $user);
    my $cookie = $c->cookie('CGISESSID');
    # Mojo doesn't use %ENV the way CGI apps do
    # Manually pass the remote_address to check_auth_cookie
    my $remote_addr = $c->tx->remote_address;
    my ($status, $sessionID) = check_cookie_auth(
                                            $cookie, undef,
                                            { remote_addr => $remote_addr });
    if ($status eq "ok") {
        $session = get_session($sessionID);
        $user = Koha::Patrons->find($session->param('number'));
        $c->stash('koha.user' => $user);
    }
    else {
        return $c->render_swagger(
            { error => "Authentication failure." },
            {},
            401
        ) if $cookie and $action_spec->{'x-koha-authorization'};
    }


    # Then check the parameters
    my @query_errors = validate_query_parameters( $c, $action_spec );

    # We do not need any authorization
    unless ( $action_spec->{'x-koha-authorization'} ) {
        return @query_errors
            ? $c->render_swagger({}, \@query_errors, 400)
            : $next->($c);
    }

    unless ($user) {
        return $c->render_swagger({ error => "Authentication required." },{},401);
    }

    my $authorization = $action_spec->{'x-koha-authorization'};
    my $permissions = $authorization->{'permissions'};

    # Check if the user is authorized
    if ( C4::Auth::haspermission($user->userid, $permissions)
        or allow_owner($c, $authorization, $user)
        or allow_guarantor($c, $authorization, $user) ) {

        # Return the query errors if exist
        return $c->render_swagger({}, \@query_errors, 400) if @query_errors;

        # Everything is ok
        return $next->($c)
    }

    return $c->render_swagger(
        { error => "Authorization failure. Missing required permission(s).",
          required_permissions => $permissions },
        {},
        403
    );
}

sub validate_query_parameters {
    my ( $c, $action_spec ) = @_;

    # Check for malformed query parameters
    my @errors;
    my %valid_parameters = map { ( $_->{in} eq 'query' ) ? ( $_->{name} => 1 ) : () } @{ $action_spec->{parameters} };
    my $existing_params = $c->req->query_params->to_hash;
    for my $param ( keys %{$existing_params} ) {
        push @errors, { path => "/query/" . $param, message => 'Malformed query string' } unless exists $valid_parameters{$param};
    }
    return @errors;
}


=head3 allow_owner

Allows access to object for its owner.

There are endpoints that should allow access for the object owner even if they
do not have the required permission, e.g. access an own reserve. This can be
achieved by defining the operation as follows:

"/holds/{reserve_id}": {
    "get": {
        ...,
        "x-koha-authorization": {
            "allow-owner": true,
            "permissions": {
                "borrowers": "1"
            }
        }
    }
}

=cut

sub allow_owner {
    my ($c, $authorization, $user) = @_;

    return unless $authorization->{'allow-owner'};

    return check_object_ownership($c, $user) if $user and $c;
}

=head3 allow_guarantor

Same as "allow_owner", but checks if the object is owned by one of C<$user>'s
guarantees.

=cut

sub allow_guarantor {
    my ($c, $authorization, $user) = @_;

    if (!$c || !$user || !$authorization || !$authorization->{'allow-guarantor'}){
        return;
    }

    my $guarantees = $user->guarantees->as_list;
    foreach my $guarantee (@{$guarantees}) {
        return 1 if check_object_ownership($c, $guarantee);
    }
}

=head3 check_object_ownership

Determines ownership of an object from request parameters.

As introducing an endpoint that allows access for object's owner; if the
parameter that will be used to determine ownership is not already inside
$parameters, add a new subroutine that checks the ownership and extend
$parameters to contain a key with parameter_name and a value of a subref to
the subroutine that you created.

=cut

sub check_object_ownership {
    my ($c, $user) = @_;

    return if not $c or not $user;

    my $parameters = {
        accountlines_id => \&_object_ownership_by_accountlines_id,
        borrowernumber  => \&_object_ownership_by_borrowernumber,
        checkout_id     => \&_object_ownership_by_checkout_id,
        reserve_id      => \&_object_ownership_by_reserve_id,
    };

    foreach my $param ( keys %{ $parameters } ) {
        my $check_ownership = $parameters->{$param};
        if ($c->stash($param)) {
            return &$check_ownership($c, $user, $c->stash($param));
        }
        elsif ($c->param($param)) {
            return &$check_ownership($c, $user, $c->param($param));
        }
        elsif ($c->req->json && $c->req->json->{$param}) {
            return 1 if &$check_ownership($c, $user, $c->req->json->{$param});
        }
    }
}

=head3 _object_ownership_by_accountlines_id

Finds a Koha::Account::Line-object by C<$accountlines_id> and checks if it
belongs to C<$user>.

=cut

sub _object_ownership_by_accountlines_id {
    my ($c, $user, $accountlines_id) = @_;

    my $accountline = Koha::Account::Lines->find($accountlines_id);
    return $accountline && $user->borrowernumber == $accountline->borrowernumber;
}

=head3 _object_ownership_by_borrowernumber

Compares C<$borrowernumber> to currently logged in C<$user>.

=cut

sub _object_ownership_by_borrowernumber {
    my ($c, $user, $borrowernumber) = @_;

    return $user->borrowernumber == $borrowernumber;
}

=head3 _object_ownership_by_checkout_id

First, attempts to find a Koha::Checkout-object by C<$issue_id>. If we find one,
compare its borrowernumber to currently logged in C<$user>. However, if an issue
is not found, attempt to find a Koha::Old::Checkout-object instead and compare its
borrowernumber to currently logged in C<$user>.

=cut

sub _object_ownership_by_checkout_id {
    my ($c, $user, $issue_id) = @_;

    my $issue = Koha::Checkouts->find($issue_id);
    $issue = Koha::Old::Checkouts->find($issue_id) unless $issue;
    return $issue && $issue->borrowernumber
            && $user->borrowernumber == $issue->borrowernumber;
}

=head3 _object_ownership_by_reserve_id

Finds a Koha::Hold-object by C<$reserve_id> and checks if it
belongs to C<$user>.

TODO: Also compare against old_reserves

=cut

sub _object_ownership_by_reserve_id {
    my ($c, $user, $reserve_id) = @_;

    my $reserve = Koha::Holds->find($reserve_id);
    return $reserve && $user->borrowernumber == $reserve->borrowernumber;
}

1;




package Koha::REST::V1::Auth;

# Copyright Koha-Suomi Oy 2017
#
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it under the
# terms of the GNU General Public License as published by the Free Software
# Foundation; either version 3 of the License, or (at your option) any later
# version.
#
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with Koha; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

use Modern::Perl;

use Mojo::Base 'Mojolicious::Controller';

use C4::Auth qw( check_cookie_auth get_session haspermission );

use Koha::Account::Lines;
use Koha::Checkouts;
use Koha::Holds;
use Koha::Old::Checkouts;
use Koha::Patrons;

use Koha::Exceptions;
use Koha::Exceptions::Authentication;
use Koha::Exceptions::Authorization;

use Scalar::Util qw( blessed );
use Try::Tiny;

=head3 under

This subroutine is called before every request to API.

=cut

sub under {
    my $c = shift->openapi->valid_input or return;;

    my $status = 0;
    try {

        $status = authenticate_api_request($c);

    } catch {
        unless (blessed($_)) {
            return $c->render(
                status => 500,
                json => { error => 'Something went wrong, check the logs.' }
            );
        }
        if ($_->isa('Koha::Exceptions::UnderMaintenance')) {
            return $c->render(status => 503, json => { error => $_->error });
        }
        elsif ($_->isa('Koha::Exceptions::Authentication::SessionExpired')) {
            return $c->render(status => 401, json => { error => $_->error });
        }
        elsif ($_->isa('Koha::Exceptions::Authentication::Required')) {
            return $c->render(status => 401, json => { error => $_->error });
        }
        elsif ($_->isa('Koha::Exceptions::Authentication')) {
            return $c->render(status => 500, json => { error => $_->error });
        }
        elsif ($_->isa('Koha::Exceptions::BadParameter')) {
            return $c->render(status => 400, json => $_->error );
        }
        elsif ($_->isa('Koha::Exceptions::Authorization::Unauthorized')) {
            return $c->render(status => 403, json => {
                error => $_->error,
                required_permissions => $_->required_permissions,
            });
        }
        elsif ($_->isa('Koha::Exceptions')) {
            return $c->render(status => 500, json => { error => $_->error });
        }
        else {
            return $c->render(
                status => 500,
                json => { error => 'Something went wrong, check the logs.' }
            );
        }
    };

    return $status;
}

=head3 authenticate_api_request

Validates authentication and allows access if authorization is not required or
if authorization is required and user has required permissions to access.

=cut

sub authenticate_api_request {
    my ( $c ) = @_;

    my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'};
    my $authorization = $spec->{'x-koha-authorization'};
    my $cookie = $c->cookie('CGISESSID');
    my ($session, $user);
    # Mojo doesn't use %ENV the way CGI apps do
    # Manually pass the remote_address to check_auth_cookie
    my $remote_addr = $c->tx->remote_address;
    my ($status, $sessionID) = check_cookie_auth(
                                            $cookie, undef,
                                            { remote_addr => $remote_addr });
    if ($status eq "ok") {
        $session = get_session($sessionID);
        $user = Koha::Patrons->find($session->param('number'));
        $c->stash('koha.user' => $user);
    }
    elsif ($status eq "maintenance") {
        Koha::Exceptions::UnderMaintenance->throw(
            error => 'System is under maintenance.'
        );
    }
    elsif ($status eq "expired" and $authorization) {
        Koha::Exceptions::Authentication::SessionExpired->throw(
            error => 'Session has been expired.'
        );
    }
    elsif ($status eq "failed" and $authorization) {
        Koha::Exceptions::Authentication::Required->throw(
            error => 'Authentication failure.'
        );
    }
    elsif ($authorization) {
        Koha::Exceptions::Authentication->throw(
            error => 'Unexpected authentication status.'
        );
    }

    # We do not need any authorization
    unless ($authorization) {
        # Check the parameters
        validate_query_parameters( $c, $spec );
        return 1;
    }

    my $permissions = $authorization->{'permissions'};
    # Check if the user is authorized
    if ( haspermission($user->userid, $permissions)
        or allow_owner($c, $authorization, $user)
        or allow_guarantor($c, $authorization, $user) ) {

        validate_query_parameters( $c, $spec );

        # Everything is ok
        return 1;
    }

    Koha::Exceptions::Authorization::Unauthorized->throw(
        error => "Authorization failure. Missing required permission(s).",
        required_permissions => $permissions,
    );
}
sub validate_query_parameters {
    my ( $c, $action_spec ) = @_;

    # Check for malformed query parameters
    my @errors;
    my %valid_parameters = map { ( $_->{in} eq 'query' ) ? ( $_->{name} => 1 ) : () } @{ $action_spec->{parameters} };
    my $existing_params = $c->req->query_params->to_hash;
    for my $param ( keys %{$existing_params} ) {
        push @errors, { path => "/query/" . $param, message => 'Malformed query string' } unless exists $valid_parameters{$param};
    }

    Koha::Exceptions::BadParameter->throw(
        error => \@errors
    ) if @errors;
}


=head3 allow_owner

Allows access to object for its owner.

There are endpoints that should allow access for the object owner even if they
do not have the required permission, e.g. access an own reserve. This can be
achieved by defining the operation as follows:

"/holds/{reserve_id}": {
    "get": {
        ...,
        "x-koha-authorization": {
            "allow-owner": true,
            "permissions": {
                "borrowers": "1"
            }
        }
    }
}

=cut

sub allow_owner {
    my ($c, $authorization, $user) = @_;

    return unless $authorization->{'allow-owner'};

    return check_object_ownership($c, $user) if $user and $c;
}

=head3 allow_guarantor

Same as "allow_owner", but checks if the object is owned by one of C<$user>'s
guarantees.

=cut

sub allow_guarantor {
    my ($c, $authorization, $user) = @_;

    if (!$c || !$user || !$authorization || !$authorization->{'allow-guarantor'}){
        return;
    }

    my $guarantees = $user->guarantees->as_list;
    foreach my $guarantee (@{$guarantees}) {
        return 1 if check_object_ownership($c, $guarantee);
    }
}

=head3 check_object_ownership

Determines ownership of an object from request parameters.

As introducing an endpoint that allows access for object's owner; if the
parameter that will be used to determine ownership is not already inside
$parameters, add a new subroutine that checks the ownership and extend
$parameters to contain a key with parameter_name and a value of a subref to
the subroutine that you created.

=cut

sub check_object_ownership {
    my ($c, $user) = @_;

    return if not $c or not $user;

    my $parameters = {
        accountlines_id => \&_object_ownership_by_accountlines_id,
        borrowernumber  => \&_object_ownership_by_borrowernumber,
        checkout_id     => \&_object_ownership_by_checkout_id,
        reserve_id      => \&_object_ownership_by_reserve_id,
    };

    foreach my $param ( keys %{ $parameters } ) {
        my $check_ownership = $parameters->{$param};
        if ($c->stash($param)) {
            return &$check_ownership($c, $user, $c->stash($param));
        }
        elsif ($c->param($param)) {
            return &$check_ownership($c, $user, $c->param($param));
        }
        elsif ($c->match->stack->[-1]->{$param}) {
            return &$check_ownership($c, $user, $c->match->stack->[-1]->{$param});
        }
        elsif ($c->req->json && $c->req->json->{$param}) {
            return 1 if &$check_ownership($c, $user, $c->req->json->{$param});
        }
    }
}

=head3 _object_ownership_by_accountlines_id

Finds a Koha::Account::Line-object by C<$accountlines_id> and checks if it
belongs to C<$user>.

=cut

sub _object_ownership_by_accountlines_id {
    my ($c, $user, $accountlines_id) = @_;

    my $accountline = Koha::Account::Lines->find($accountlines_id);
    return $accountline && $user->borrowernumber == $accountline->borrowernumber;
}

=head3 _object_ownership_by_borrowernumber

Compares C<$borrowernumber> to currently logged in C<$user>.

=cut

sub _object_ownership_by_borrowernumber {
    my ($c, $user, $borrowernumber) = @_;

    return $user->borrowernumber == $borrowernumber;
}

=head3 _object_ownership_by_checkout_id

First, attempts to find a Koha::Checkout-object by C<$issue_id>. If we find one,
compare its borrowernumber to currently logged in C<$user>. However, if an issue
is not found, attempt to find a Koha::Old::Checkout-object instead and compare its
borrowernumber to currently logged in C<$user>.

=cut

sub _object_ownership_by_checkout_id {
    my ($c, $user, $issue_id) = @_;

    my $issue = Koha::Checkouts->find($issue_id);
    $issue = Koha::Old::Checkouts->find($issue_id) unless $issue;
    return $issue && $issue->borrowernumber
            && $user->borrowernumber == $issue->borrowernumber;
}

=head3 _object_ownership_by_reserve_id

Finds a Koha::Hold-object by C<$reserve_id> and checks if it
belongs to C<$user>.

TODO: Also compare against old_reserves

=cut

sub _object_ownership_by_reserve_id {
    my ($c, $user, $reserve_id) = @_;

    my $reserve = Koha::Holds->find($reserve_id);
    return $reserve && $user->borrowernumber == $reserve->borrowernumber;
}

1;




#!/usr/bin/env perl

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it under the
# terms of the GNU General Public License as published by the Free Software
# Foundation; either version 3 of the License, or (at your option) any later
# version.
#
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with Koha; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

use Modern::Perl;

use Test::More tests => 1;
use Test::Mojo;
use Test::Warn;

use t::lib::TestBuilder;
use t::lib::Mocks;

use C4::Auth;
use Koha::Database;

my $schema  = Koha::Database->new->schema;
my $builder = t::lib::TestBuilder->new;

# FIXME: sessionStorage defaults to mysql, but it seems to break transaction handling
# this affects the other REST api tests
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );

my $remote_address = '127.0.0.1';
my $t              = Test::Mojo->new('Koha::REST::V1');
my $tx;

subtest 'under() tests' => sub {
    plan tests => 15;

    $schema->storage->txn_begin;

    my ($borrowernumber, $session_id) = create_user_and_session();

    # 401 (no authentication)
    $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
    $t->request_ok($tx)
      ->status_is(401)
      ->json_is('/error', 'Authentication failure.');

    # 403 (no permission)
    $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
    $tx->req->cookies(
        { name => 'CGISESSID', value => $session_id } );
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
    $t->request_ok($tx)
      ->status_is(403)
      ->json_is('/error', 'Authorization failure. Missing required permission(s).');

    # 401 (session expired)
    my $session = C4::Auth::get_session($session_id);
    $session->delete;
    $session->flush;
    $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
    $tx->req->cookies(
        { name => 'CGISESSID', value => $session_id } );
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
    $t->request_ok($tx)
      ->status_is(401)
      ->json_is('/error', 'Session has been expired.');

    # 503 (under maintenance & pending update)
    t::lib::Mocks::mock_preference('Version', 1);
    $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
    $t->request_ok($tx)
      ->status_is(503)
      ->json_is('/error', 'System is under maintenance.');

    # 503 (under maintenance & database not installed)
    t::lib::Mocks::mock_preference('Version', undef);
    $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
    $t->request_ok($tx)
      ->status_is(503)
      ->json_is('/error', 'System is under maintenance.');

    $schema->storage->txn_rollback;
};

sub create_user_and_session {
    my $user = $builder->build(
        {
            source => 'Borrower',
            value  => {
                flags => 0
            }
        }
    );

    # Create a session for the authorized user
    my $session = C4::Auth::get_session('');
    $session->param( 'number',   $user->{borrowernumber} );
    $session->param( 'id',       $user->{userid} );
    $session->param( 'ip',       '127.0.0.1' );
    $session->param( 'lasttime', time() );
    $session->flush;

    return ( $user->{borrowernumber}, $session->id );
}

1;

Return to bug 18137

Lines 16-30 package Koha::REST::V1; Link Here

(-)a/Koha/REST/V1.pm (-242 / +6 lines)
16	# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.	16	# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
17		17
18	use Modern::Perl;	18	use Modern::Perl;
		19
19	use Mojo::Base 'Mojolicious';	20	use Mojo::Base 'Mojolicious';
20		21
21	use C4::Auth qw( check_cookie_auth get_session haspermission );
22	use C4::Context;	22	use C4::Context;
23	use Koha::Account::Lines;
24	use Koha::Checkouts;
25	use Koha::Holds;
26	use Koha::Old::Checkouts;
27	use Koha::Patrons;
28		23
29	=head1 NAME	24	=head1 NAME
30		25
Lines 51-294 sub startup { Link Here
51	$self->secrets([$secret_passphrase]);	46	$self->secrets([$secret_passphrase]);
52	}	47	}
53		48
54	$self->plugin(Swagger2 => {	49	$self->plugin(OpenAPI => {
55	url => $self->home->rel_file("api/v1/swagger/swagger.json"),	50	url => $self->home->rel_file("api/v1/swagger/swagger.json"),
56	validate => 1,	51	route => $self->routes->under('/api/v1')->to('Auth#under'),
57	spec_path => '/spec'	52	allow_invalid_ref => 1, # required by our spec because $ref directly under
		53	# Paths-, Parameters-, Definitions- & Info-object
		54	# is not allowed by the OpenAPI specification.
58	});	55	});
59	}	56	}
60		57
61	=head3 authenticate_api_request
62
63	Validates authentication and allows access if authorization is not required or
64	if authorization is required and user has required permissions to access.
65
66	This subroutine is called before every request to API.
67
68	=cut
69
70	sub authenticate_api_request {
71	my ($next, $c, $action_spec) = @_;
72
73	my ($session, $user);
74	my $cookie = $c->cookie('CGISESSID');
75	# Mojo doesn't use %ENV the way CGI apps do
76	# Manually pass the remote_address to check_auth_cookie
77	my $remote_addr = $c->tx->remote_address;
78	my ($status, $sessionID) = check_cookie_auth(
79	$cookie, undef,
80	{ remote_addr => $remote_addr });
81	if ($status eq "ok") {
82	$session = get_session($sessionID);
83	$user = Koha::Patrons->find($session->param('number'));
84	$c->stash('koha.user' => $user);
85	}
86	else {
87	return $c->render_swagger(
88	{ error => "Authentication failure." },
89	{},
90	401
91	) if $cookie and $action_spec->{'x-koha-authorization'};
92	}
93
94
95	# Then check the parameters
96	my @query_errors = validate_query_parameters( $c, $action_spec );
97
98	# We do not need any authorization
99	unless ( $action_spec->{'x-koha-authorization'} ) {
100	return @query_errors
101	? $c->render_swagger({}, \@query_errors, 400)
102	: $next->($c);
103	}
104
105	unless ($user) {
106	return $c->render_swagger({ error => "Authentication required." },{},401);
107	}
108
109	my $authorization = $action_spec->{'x-koha-authorization'};
110	my $permissions = $authorization->{'permissions'};
111
112	# Check if the user is authorized
113	if ( C4::Auth::haspermission($user->userid, $permissions)
114	or allow_owner($c, $authorization, $user)
115	or allow_guarantor($c, $authorization, $user) ) {
116
117	# Return the query errors if exist
118	return $c->render_swagger({}, \@query_errors, 400) if @query_errors;
119
120	# Everything is ok
121	return $next->($c)
122	}
123
124	return $c->render_swagger(
125	{ error => "Authorization failure. Missing required permission(s).",
126	required_permissions => $permissions },
127	{},
128	403
129	);
130	}
131
132	sub validate_query_parameters {
133	my ( $c, $action_spec ) = @_;
134
135	# Check for malformed query parameters
136	my @errors;
137	my %valid_parameters = map { ( $_->{in} eq 'query' ) ? ( $_->{name} => 1 ) : () } @{ $action_spec->{parameters} };
138	my $existing_params = $c->req->query_params->to_hash;
139	for my $param ( keys %{$existing_params} ) {
140	push @errors, { path => "/query/" . $param, message => 'Malformed query string' } unless exists $valid_parameters{$param};
141	}
142	return @errors;
143	}
144
145
146	=head3 allow_owner
147
148	Allows access to object for its owner.
149
150	There are endpoints that should allow access for the object owner even if they
151	do not have the required permission, e.g. access an own reserve. This can be
152	achieved by defining the operation as follows:
153
154	"/holds/{reserve_id}": {
155	"get": {
156	...,
157	"x-koha-authorization": {
158	"allow-owner": true,
159	"permissions": {
160	"borrowers": "1"
161	}
162	}
163	}
164	}
165
166	=cut
167
168	sub allow_owner {
169	my ($c, $authorization, $user) = @_;
170
171	return unless $authorization->{'allow-owner'};
172
173	return check_object_ownership($c, $user) if $user and $c;
174	}
175
176	=head3 allow_guarantor
177
178	Same as "allow_owner", but checks if the object is owned by one of C<$user>'s
179	guarantees.
180
181	=cut
182
183	sub allow_guarantor {
184	my ($c, $authorization, $user) = @_;
185
186	if (!$c \|\| !$user \|\| !$authorization \|\| !$authorization->{'allow-guarantor'}){
187	return;
188	}
189
190	my $guarantees = $user->guarantees->as_list;
191	foreach my $guarantee (@{$guarantees}) {
192	return 1 if check_object_ownership($c, $guarantee);
193	}
194	}
195
196	=head3 check_object_ownership
197
198	Determines ownership of an object from request parameters.
199
200	As introducing an endpoint that allows access for object's owner; if the
201	parameter that will be used to determine ownership is not already inside
202	$parameters, add a new subroutine that checks the ownership and extend
203	$parameters to contain a key with parameter_name and a value of a subref to
204	the subroutine that you created.
205
206	=cut
207
208	sub check_object_ownership {
209	my ($c, $user) = @_;
210
211	return if not $c or not $user;
212
213	my $parameters = {
214	accountlines_id => \&_object_ownership_by_accountlines_id,
215	borrowernumber => \&_object_ownership_by_borrowernumber,
216	checkout_id => \&_object_ownership_by_checkout_id,
217	reserve_id => \&_object_ownership_by_reserve_id,
218	};
219
220	foreach my $param ( keys %{ $parameters } ) {
221	my $check_ownership = $parameters->{$param};
222	if ($c->stash($param)) {
223	return &$check_ownership($c, $user, $c->stash($param));
224	}
225	elsif ($c->param($param)) {
226	return &$check_ownership($c, $user, $c->param($param));
227	}
228	elsif ($c->req->json && $c->req->json->{$param}) {
229	return 1 if &$check_ownership($c, $user, $c->req->json->{$param});
230	}
231	}
232	}
233
234	=head3 _object_ownership_by_accountlines_id
235
236	Finds a Koha::Account::Line-object by C<$accountlines_id> and checks if it
237	belongs to C<$user>.
238
239	=cut
240
241	sub _object_ownership_by_accountlines_id {
242	my ($c, $user, $accountlines_id) = @_;
243
244	my $accountline = Koha::Account::Lines->find($accountlines_id);
245	return $accountline && $user->borrowernumber == $accountline->borrowernumber;
246	}
247
248	=head3 _object_ownership_by_borrowernumber
249
250	Compares C<$borrowernumber> to currently logged in C<$user>.
251
252	=cut
253
254	sub _object_ownership_by_borrowernumber {
255	my ($c, $user, $borrowernumber) = @_;
256
257	return $user->borrowernumber == $borrowernumber;
258	}
259
260	=head3 _object_ownership_by_checkout_id
261
262	First, attempts to find a Koha::Checkout-object by C<$issue_id>. If we find one,
263	compare its borrowernumber to currently logged in C<$user>. However, if an issue
264	is not found, attempt to find a Koha::Old::Checkout-object instead and compare its
265	borrowernumber to currently logged in C<$user>.
266
267	=cut
268
269	sub _object_ownership_by_checkout_id {
270	my ($c, $user, $issue_id) = @_;
271
272	my $issue = Koha::Checkouts->find($issue_id);
273	$issue = Koha::Old::Checkouts->find($issue_id) unless $issue;
274	return $issue && $issue->borrowernumber
275	&& $user->borrowernumber == $issue->borrowernumber;
276	}
277
278	=head3 _object_ownership_by_reserve_id
279
280	Finds a Koha::Hold-object by C<$reserve_id> and checks if it
281	belongs to C<$user>.
282
283	TODO: Also compare against old_reserves
284
285	=cut
286
287	sub _object_ownership_by_reserve_id {
288	my ($c, $user, $reserve_id) = @_;
289
290	my $reserve = Koha::Holds->find($reserve_id);
291	return $reserve && $user->borrowernumber == $reserve->borrowernumber;
292	}
293
294	1;	58	1;

Line 0 Link Here

(-)a/Koha/REST/V1/Auth.pm (+333 lines)
		1	package Koha::REST::V1::Auth;
		2
		3	# Copyright Koha-Suomi Oy 2017
		4	#
		5	# This file is part of Koha.
		6	#
		7	# Koha is free software; you can redistribute it and/or modify it under the
		8	# terms of the GNU General Public License as published by the Free Software
		9	# Foundation; either version 3 of the License, or (at your option) any later
		10	# version.
		11	#
		12	# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
		13	# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
		14	# A PARTICULAR PURPOSE. See the GNU General Public License for more details.
		15	#
		16	# You should have received a copy of the GNU General Public License along
		17	# with Koha; if not, write to the Free Software Foundation, Inc.,
		18	# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
		19
		20	use Modern::Perl;
		21
		22	use Mojo::Base 'Mojolicious::Controller';
		23
		24	use C4::Auth qw( check_cookie_auth get_session haspermission );
		25
		26	use Koha::Account::Lines;
		27	use Koha::Checkouts;
		28	use Koha::Holds;
		29	use Koha::Old::Checkouts;
		30	use Koha::Patrons;
		31
		32	use Koha::Exceptions;
		33	use Koha::Exceptions::Authentication;
		34	use Koha::Exceptions::Authorization;
		35
		36	use Scalar::Util qw( blessed );
		37	use Try::Tiny;
		38
		39	=head3 under
		40
		41	This subroutine is called before every request to API.
		42
		43	=cut
		44
		45	sub under {
		46	my $c = shift->openapi->valid_input or return;;
		47
		48	my $status = 0;
		49	try {
		50
		51	$status = authenticate_api_request($c);
		52
		53	} catch {
		54	unless (blessed($_)) {
		55	return $c->render(
		56	status => 500,
		57	json => { error => 'Something went wrong, check the logs.' }
		58	);
		59	}
		60	if ($_->isa('Koha::Exceptions::UnderMaintenance')) {
		61	return $c->render(status => 503, json => { error => $_->error });
		62	}
		63	elsif ($_->isa('Koha::Exceptions::Authentication::SessionExpired')) {
		64	return $c->render(status => 401, json => { error => $_->error });
65	}
66	elsif ($_->isa('Koha::Exceptions::Authentication::Required')) {
67	return $c->render(status => 401, json => { error => $_->error });
68	}
69	elsif ($_->isa('Koha::Exceptions::Authentication')) {
70	return $c->render(status => 500, json => { error => $_->error });
71	}
72	elsif ($_->isa('Koha::Exceptions::BadParameter')) {
73	return $c->render(status => 400, json => $_->error );
74	}
75	elsif ($_->isa('Koha::Exceptions::Authorization::Unauthorized')) {
76	return $c->render(status => 403, json => {
77	error => $_->error,
78	required_permissions => $_->required_permissions,
79	});
80	}
81	elsif ($_->isa('Koha::Exceptions')) {
82	return $c->render(status => 500, json => { error => $_->error });
83	}
84	else {
85	return $c->render(
86	status => 500,
87	json => { error => 'Something went wrong, check the logs.' }
88	);
89	}
90	};
91
92	return $status;
93	}
94
95	=head3 authenticate_api_request
96
97	Validates authentication and allows access if authorization is not required or
98	if authorization is required and user has required permissions to access.
99
100	=cut
101
102	sub authenticate_api_request {
103	my ( $c ) = @_;
104
105	my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'};
106	my $authorization = $spec->{'x-koha-authorization'};
107	my $cookie = $c->cookie('CGISESSID');
108	my ($session, $user);
109	# Mojo doesn't use %ENV the way CGI apps do
110	# Manually pass the remote_address to check_auth_cookie
111	my $remote_addr = $c->tx->remote_address;
112	my ($status, $sessionID) = check_cookie_auth(
113	$cookie, undef,
114	{ remote_addr => $remote_addr });
115	if ($status eq "ok") {
116	$session = get_session($sessionID);
117	$user = Koha::Patrons->find($session->param('number'));
118	$c->stash('koha.user' => $user);
119	}
120	elsif ($status eq "maintenance") {
121	Koha::Exceptions::UnderMaintenance->throw(
122	error => 'System is under maintenance.'
123	);
124	}
125	elsif ($status eq "expired" and $authorization) {
126	Koha::Exceptions::Authentication::SessionExpired->throw(
127	error => 'Session has been expired.'
128	);
129	}
130	elsif ($status eq "failed" and $authorization) {
131	Koha::Exceptions::Authentication::Required->throw(
132	error => 'Authentication failure.'
133	);
134	}
135	elsif ($authorization) {
136	Koha::Exceptions::Authentication->throw(
137	error => 'Unexpected authentication status.'
138	);
139	}
140
141	# We do not need any authorization
142	unless ($authorization) {
143	# Check the parameters
144	validate_query_parameters( $c, $spec );
145	return 1;
146	}
147
148	my $permissions = $authorization->{'permissions'};
149	# Check if the user is authorized
150	if ( haspermission($user->userid, $permissions)
151	or allow_owner($c, $authorization, $user)
152	or allow_guarantor($c, $authorization, $user) ) {
153
154	validate_query_parameters( $c, $spec );
155
156	# Everything is ok
157	return 1;
158	}
159
160	Koha::Exceptions::Authorization::Unauthorized->throw(
161	error => "Authorization failure. Missing required permission(s).",
162	required_permissions => $permissions,
163	);
164	}
165	sub validate_query_parameters {
166	my ( $c, $action_spec ) = @_;
167
168	# Check for malformed query parameters
169	my @errors;
170	my %valid_parameters = map { ( $_->{in} eq 'query' ) ? ( $_->{name} => 1 ) : () } @{ $action_spec->{parameters} };
171	my $existing_params = $c->req->query_params->to_hash;
172	for my $param ( keys %{$existing_params} ) {
173	push @errors, { path => "/query/" . $param, message => 'Malformed query string' } unless exists $valid_parameters{$param};
174	}
175
176	Koha::Exceptions::BadParameter->throw(
177	error => \@errors
178	) if @errors;
179	}
180
181
182	=head3 allow_owner
183
184	Allows access to object for its owner.
185
186	There are endpoints that should allow access for the object owner even if they
187	do not have the required permission, e.g. access an own reserve. This can be
188	achieved by defining the operation as follows:
189
190	"/holds/{reserve_id}": {
191	"get": {
192	...,
193	"x-koha-authorization": {
194	"allow-owner": true,
195	"permissions": {
196	"borrowers": "1"
197	}
198	}
199	}
200	}
201
202	=cut
203
204	sub allow_owner {
205	my ($c, $authorization, $user) = @_;
206
207	return unless $authorization->{'allow-owner'};
208
209	return check_object_ownership($c, $user) if $user and $c;
210	}
211
212	=head3 allow_guarantor
213
214	Same as "allow_owner", but checks if the object is owned by one of C<$user>'s
215	guarantees.
216
217	=cut
218
219	sub allow_guarantor {
220	my ($c, $authorization, $user) = @_;
221
222	if (!$c \|\| !$user \|\| !$authorization \|\| !$authorization->{'allow-guarantor'}){
223	return;
224	}
225
226	my $guarantees = $user->guarantees->as_list;
227	foreach my $guarantee (@{$guarantees}) {
228	return 1 if check_object_ownership($c, $guarantee);
229	}
230	}
231
232	=head3 check_object_ownership
233
234	Determines ownership of an object from request parameters.
235
236	As introducing an endpoint that allows access for object's owner; if the
237	parameter that will be used to determine ownership is not already inside
238	$parameters, add a new subroutine that checks the ownership and extend
239	$parameters to contain a key with parameter_name and a value of a subref to
240	the subroutine that you created.
241
242	=cut
243
244	sub check_object_ownership {
245	my ($c, $user) = @_;
246
247	return if not $c or not $user;
248
249	my $parameters = {
250	accountlines_id => \&_object_ownership_by_accountlines_id,
251	borrowernumber => \&_object_ownership_by_borrowernumber,
252	checkout_id => \&_object_ownership_by_checkout_id,
253	reserve_id => \&_object_ownership_by_reserve_id,
254	};
255
256	foreach my $param ( keys %{ $parameters } ) {
257	my $check_ownership = $parameters->{$param};
258	if ($c->stash($param)) {
259	return &$check_ownership($c, $user, $c->stash($param));
260	}
261	elsif ($c->param($param)) {
262	return &$check_ownership($c, $user, $c->param($param));
263	}
264	elsif ($c->match->stack->[-1]->{$param}) {
265	return &$check_ownership($c, $user, $c->match->stack->[-1]->{$param});
266	}
267	elsif ($c->req->json && $c->req->json->{$param}) {
268	return 1 if &$check_ownership($c, $user, $c->req->json->{$param});
269	}
270	}
271	}
272
273	=head3 _object_ownership_by_accountlines_id
274
275	Finds a Koha::Account::Line-object by C<$accountlines_id> and checks if it
276	belongs to C<$user>.
277
278	=cut
279
280	sub _object_ownership_by_accountlines_id {
281	my ($c, $user, $accountlines_id) = @_;
282
283	my $accountline = Koha::Account::Lines->find($accountlines_id);
284	return $accountline && $user->borrowernumber == $accountline->borrowernumber;
285	}
286
287	=head3 _object_ownership_by_borrowernumber
288
289	Compares C<$borrowernumber> to currently logged in C<$user>.
290
291	=cut
292
293	sub _object_ownership_by_borrowernumber {
294	my ($c, $user, $borrowernumber) = @_;
295
296	return $user->borrowernumber == $borrowernumber;
297	}
298
299	=head3 _object_ownership_by_checkout_id
300
301	First, attempts to find a Koha::Checkout-object by C<$issue_id>. If we find one,
302	compare its borrowernumber to currently logged in C<$user>. However, if an issue
303	is not found, attempt to find a Koha::Old::Checkout-object instead and compare its
304	borrowernumber to currently logged in C<$user>.
305
306	=cut
307
308	sub _object_ownership_by_checkout_id {
309	my ($c, $user, $issue_id) = @_;
310
311	my $issue = Koha::Checkouts->find($issue_id);
312	$issue = Koha::Old::Checkouts->find($issue_id) unless $issue;
313	return $issue && $issue->borrowernumber
314	&& $user->borrowernumber == $issue->borrowernumber;
315	}
316
317	=head3 _object_ownership_by_reserve_id
318
319	Finds a Koha::Hold-object by C<$reserve_id> and checks if it
320	belongs to C<$user>.
321
322	TODO: Also compare against old_reserves
323
324	=cut
325
326	sub _object_ownership_by_reserve_id {
327	my ($c, $user, $reserve_id) = @_;
328
329	my $reserve = Koha::Holds->find($reserve_id);
330	return $reserve && $user->borrowernumber == $reserve->borrowernumber;
331	}
332
333	1;

Line 0 Link Here

(-)a/t/db_dependent/api/v1/auth.t (-1 / +116 lines)
0	-	1	#!/usr/bin/env perl
		2
		3	# This file is part of Koha.
		4	#
		5	# Koha is free software; you can redistribute it and/or modify it under the
		6	# terms of the GNU General Public License as published by the Free Software
		7	# Foundation; either version 3 of the License, or (at your option) any later
		8	# version.
		9	#
		10	# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
		11	# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
		12	# A PARTICULAR PURPOSE. See the GNU General Public License for more details.
		13	#
		14	# You should have received a copy of the GNU General Public License along
		15	# with Koha; if not, write to the Free Software Foundation, Inc.,
		16	# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
		17
		18	use Modern::Perl;
		19
		20	use Test::More tests => 1;
		21	use Test::Mojo;
		22	use Test::Warn;
		23
		24	use t::lib::TestBuilder;
		25	use t::lib::Mocks;
		26
		27	use C4::Auth;
		28	use Koha::Database;
		29
		30	my $schema = Koha::Database->new->schema;
		31	my $builder = t::lib::TestBuilder->new;
		32
		33	# FIXME: sessionStorage defaults to mysql, but it seems to break transaction handling
		34	# this affects the other REST api tests
		35	t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
		36
		37	my $remote_address = '127.0.0.1';
		38	my $t = Test::Mojo->new('Koha::REST::V1');
		39	my $tx;
		40
		41	subtest 'under() tests' => sub {
		42	plan tests => 15;
		43
		44	$schema->storage->txn_begin;
		45
		46	my ($borrowernumber, $session_id) = create_user_and_session();
		47
		48	# 401 (no authentication)
		49	$tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
		50	$tx->req->env( { REMOTE_ADDR => $remote_address } );
		51	$t->request_ok($tx)
		52	->status_is(401)
		53	->json_is('/error', 'Authentication failure.');
		54
		55	# 403 (no permission)
		56	$tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
		57	$tx->req->cookies(
		58	{ name => 'CGISESSID', value => $session_id } );
		59	$tx->req->env( { REMOTE_ADDR => $remote_address } );
		60	$t->request_ok($tx)
		61	->status_is(403)
		62	->json_is('/error', 'Authorization failure. Missing required permission(s).');
		63
		64	# 401 (session expired)
		65	my $session = C4::Auth::get_session($session_id);
66	$session->delete;
67	$session->flush;
68	$tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
69	$tx->req->cookies(
70	{ name => 'CGISESSID', value => $session_id } );
71	$tx->req->env( { REMOTE_ADDR => $remote_address } );
72	$t->request_ok($tx)
73	->status_is(401)
74	->json_is('/error', 'Session has been expired.');
75
76	# 503 (under maintenance & pending update)
77	t::lib::Mocks::mock_preference('Version', 1);
78	$tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
79	$tx->req->env( { REMOTE_ADDR => $remote_address } );
80	$t->request_ok($tx)
81	->status_is(503)
82	->json_is('/error', 'System is under maintenance.');
83
84	# 503 (under maintenance & database not installed)
85	t::lib::Mocks::mock_preference('Version', undef);
86	$tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
87	$tx->req->env( { REMOTE_ADDR => $remote_address } );
88	$t->request_ok($tx)
89	->status_is(503)
90	->json_is('/error', 'System is under maintenance.');
91
92	$schema->storage->txn_rollback;
93	};
94
95	sub create_user_and_session {
96	my $user = $builder->build(
97	{
98	source => 'Borrower',
99	value => {
100	flags => 0
101	}
102	}
103	);
104
105	# Create a session for the authorized user
106	my $session = C4::Auth::get_session('');
107	$session->param( 'number', $user->{borrowernumber} );
108	$session->param( 'id', $user->{userid} );
109	$session->param( 'ip', '127.0.0.1' );
110	$session->param( 'lasttime', time() );
111	$session->flush;
112
113	return ( $user->{borrowernumber}, $session->id );
114	}
115
116	1;