|
Lines 1-25
Link Here
|
| 1 |
package Koha::OAuth; |
1 |
package Koha::OAuth; |
| 2 |
|
2 |
|
| 3 |
use Modern::Perl; |
3 |
use Modern::Perl; |
| 4 |
use Net::OAuth2::AuthorizationServer::ClientCredentialsGrant; |
|
|
| 5 |
use Koha::OAuthAccessTokens; |
4 |
use Koha::OAuthAccessTokens; |
| 6 |
use Koha::OAuthAccessToken; |
5 |
use Koha::OAuthAccessToken; |
| 7 |
|
6 |
|
| 8 |
sub grant { |
7 |
sub config { |
| 9 |
my $grant = Net::OAuth2::AuthorizationServer::ClientCredentialsGrant->new( |
8 |
return { |
| 10 |
verify_client_cb => \&_verify_client_cb, |
9 |
verify_client_cb => \&_verify_client_cb, |
| 11 |
store_access_token_cb => \&_store_access_token_cb, |
10 |
store_access_token_cb => \&_store_access_token_cb, |
| 12 |
verify_access_token_cb => \&_verify_access_token_cb |
11 |
verify_access_token_cb => \&_verify_access_token_cb |
| 13 |
); |
12 |
}; |
| 14 |
|
|
|
| 15 |
return $grant; |
| 16 |
} |
13 |
} |
| 17 |
|
14 |
|
| 18 |
sub _verify_client_cb { |
15 |
sub _verify_client_cb { |
| 19 |
my (%args) = @_; |
16 |
my (%args) = @_; |
| 20 |
|
17 |
|
| 21 |
my ($client_id, $scopes_ref, $client_secret) |
18 |
my ($client_id, $client_secret) |
| 22 |
= @args{ qw/ client_id scopes client_secret / }; |
19 |
= @args{ qw/ client_id client_secret / }; |
| 23 |
|
20 |
|
| 24 |
return (0, 'unauthorized_client') unless $client_id; |
21 |
return (0, 'unauthorized_client') unless $client_id; |
| 25 |
|
22 |
|
|
Lines 30-57
sub _verify_client_cb {
Link Here
|
| 30 |
|
27 |
|
| 31 |
return (0, 'access_denied') unless $client_secret eq $client->{client_secret}; |
28 |
return (0, 'access_denied') unless $client_secret eq $client->{client_secret}; |
| 32 |
|
29 |
|
| 33 |
$client->{scope} //= []; |
30 |
return (1, undef, []); |
| 34 |
$client->{scope} = [ $client->{scope} ] if ref $client->{scope} ne 'ARRAY'; |
|
|
| 35 |
my $client_scopes = []; |
| 36 |
foreach my $scope ( @{ $scopes_ref // [] } ) { |
| 37 |
if (!grep { $_ eq $scope } @{ $client->{scope} }) { |
| 38 |
return (0, 'invalid_scope'); |
| 39 |
} |
| 40 |
push @$client_scopes, $scope; |
| 41 |
} |
| 42 |
|
| 43 |
return (1, undef, $client_scopes); |
| 44 |
} |
31 |
} |
| 45 |
|
32 |
|
| 46 |
sub _store_access_token_cb { |
33 |
sub _store_access_token_cb { |
| 47 |
my ( %args ) = @_; |
34 |
my ( %args ) = @_; |
| 48 |
|
35 |
|
| 49 |
my ( $client_id, $access_token, $expires_in, $scopes_ref ) |
36 |
my ( $client_id, $access_token, $expires_in ) |
| 50 |
= @args{ qw/ client_id access_token expires_in scopes / }; |
37 |
= @args{ qw/ client_id access_token expires_in / }; |
| 51 |
|
38 |
|
| 52 |
my $at = Koha::OAuthAccessToken->new({ |
39 |
my $at = Koha::OAuthAccessToken->new({ |
| 53 |
access_token => $access_token, |
40 |
access_token => $access_token, |
| 54 |
scope => join (' ', @$scopes_ref), |
|
|
| 55 |
expires => time + $expires_in, |
41 |
expires => time + $expires_in, |
| 56 |
client_id => $client_id, |
42 |
client_id => $client_id, |
| 57 |
}); |
43 |
}); |
|
Lines 63-69
sub _store_access_token_cb {
Link Here
|
| 63 |
sub _verify_access_token_cb { |
49 |
sub _verify_access_token_cb { |
| 64 |
my (%args) = @_; |
50 |
my (%args) = @_; |
| 65 |
|
51 |
|
| 66 |
my ($access_token, $scopes_ref) = @args{qw(access_token scopes)}; |
52 |
my $access_token = $args{access_token}; |
| 67 |
|
53 |
|
| 68 |
my $at = Koha::OAuthAccessTokens->find($access_token); |
54 |
my $at = Koha::OAuthAccessTokens->find($access_token); |
| 69 |
if ($at) { |
55 |
if ($at) { |
|
Lines 72-83
sub _verify_access_token_cb {
Link Here
|
| 72 |
$at->delete; |
58 |
$at->delete; |
| 73 |
|
59 |
|
| 74 |
return (0, 'invalid_grant') |
60 |
return (0, 'invalid_grant') |
| 75 |
} elsif ( $scopes_ref ) { |
|
|
| 76 |
foreach my $scope ( @{ $scopes_ref // [] } ) { |
| 77 |
unless ($at->has_scope($scope)) { |
| 78 |
return (0, 'invalid_grant'); |
| 79 |
} |
| 80 |
} |
| 81 |
} |
61 |
} |
| 82 |
|
62 |
|
| 83 |
return $at->unblessed; |
63 |
return $at->unblessed; |