Lines 1-25
Link Here
|
1 |
package Koha::OAuth; |
1 |
package Koha::OAuth; |
2 |
|
2 |
|
3 |
use Modern::Perl; |
3 |
use Modern::Perl; |
4 |
use Net::OAuth2::AuthorizationServer::ClientCredentialsGrant; |
|
|
5 |
use Koha::OAuthAccessTokens; |
4 |
use Koha::OAuthAccessTokens; |
6 |
use Koha::OAuthAccessToken; |
5 |
use Koha::OAuthAccessToken; |
7 |
|
6 |
|
8 |
sub grant { |
7 |
sub config { |
9 |
my $grant = Net::OAuth2::AuthorizationServer::ClientCredentialsGrant->new( |
8 |
return { |
10 |
verify_client_cb => \&_verify_client_cb, |
9 |
verify_client_cb => \&_verify_client_cb, |
11 |
store_access_token_cb => \&_store_access_token_cb, |
10 |
store_access_token_cb => \&_store_access_token_cb, |
12 |
verify_access_token_cb => \&_verify_access_token_cb |
11 |
verify_access_token_cb => \&_verify_access_token_cb |
13 |
); |
12 |
}; |
14 |
|
|
|
15 |
return $grant; |
16 |
} |
13 |
} |
17 |
|
14 |
|
18 |
sub _verify_client_cb { |
15 |
sub _verify_client_cb { |
19 |
my (%args) = @_; |
16 |
my (%args) = @_; |
20 |
|
17 |
|
21 |
my ($client_id, $scopes_ref, $client_secret) |
18 |
my ($client_id, $client_secret) |
22 |
= @args{ qw/ client_id scopes client_secret / }; |
19 |
= @args{ qw/ client_id client_secret / }; |
23 |
|
20 |
|
24 |
return (0, 'unauthorized_client') unless $client_id; |
21 |
return (0, 'unauthorized_client') unless $client_id; |
25 |
|
22 |
|
Lines 30-57
sub _verify_client_cb {
Link Here
|
30 |
|
27 |
|
31 |
return (0, 'access_denied') unless $client_secret eq $client->{client_secret}; |
28 |
return (0, 'access_denied') unless $client_secret eq $client->{client_secret}; |
32 |
|
29 |
|
33 |
$client->{scope} //= []; |
30 |
return (1, undef, []); |
34 |
$client->{scope} = [ $client->{scope} ] if ref $client->{scope} ne 'ARRAY'; |
|
|
35 |
my $client_scopes = []; |
36 |
foreach my $scope ( @{ $scopes_ref // [] } ) { |
37 |
if (!grep { $_ eq $scope } @{ $client->{scope} }) { |
38 |
return (0, 'invalid_scope'); |
39 |
} |
40 |
push @$client_scopes, $scope; |
41 |
} |
42 |
|
43 |
return (1, undef, $client_scopes); |
44 |
} |
31 |
} |
45 |
|
32 |
|
46 |
sub _store_access_token_cb { |
33 |
sub _store_access_token_cb { |
47 |
my ( %args ) = @_; |
34 |
my ( %args ) = @_; |
48 |
|
35 |
|
49 |
my ( $client_id, $access_token, $expires_in, $scopes_ref ) |
36 |
my ( $client_id, $access_token, $expires_in ) |
50 |
= @args{ qw/ client_id access_token expires_in scopes / }; |
37 |
= @args{ qw/ client_id access_token expires_in / }; |
51 |
|
38 |
|
52 |
my $at = Koha::OAuthAccessToken->new({ |
39 |
my $at = Koha::OAuthAccessToken->new({ |
53 |
access_token => $access_token, |
40 |
access_token => $access_token, |
54 |
scope => join (' ', @$scopes_ref), |
|
|
55 |
expires => time + $expires_in, |
41 |
expires => time + $expires_in, |
56 |
client_id => $client_id, |
42 |
client_id => $client_id, |
57 |
}); |
43 |
}); |
Lines 63-69
sub _store_access_token_cb {
Link Here
|
63 |
sub _verify_access_token_cb { |
49 |
sub _verify_access_token_cb { |
64 |
my (%args) = @_; |
50 |
my (%args) = @_; |
65 |
|
51 |
|
66 |
my ($access_token, $scopes_ref) = @args{qw(access_token scopes)}; |
52 |
my $access_token = $args{access_token}; |
67 |
|
53 |
|
68 |
my $at = Koha::OAuthAccessTokens->find($access_token); |
54 |
my $at = Koha::OAuthAccessTokens->find($access_token); |
69 |
if ($at) { |
55 |
if ($at) { |
Lines 72-83
sub _verify_access_token_cb {
Link Here
|
72 |
$at->delete; |
58 |
$at->delete; |
73 |
|
59 |
|
74 |
return (0, 'invalid_grant') |
60 |
return (0, 'invalid_grant') |
75 |
} elsif ( $scopes_ref ) { |
|
|
76 |
foreach my $scope ( @{ $scopes_ref // [] } ) { |
77 |
unless ($at->has_scope($scope)) { |
78 |
return (0, 'invalid_grant'); |
79 |
} |
80 |
} |
81 |
} |
61 |
} |
82 |
|
62 |
|
83 |
return $at->unblessed; |
63 |
return $at->unblessed; |