| 
      
            Lines 113-139
          sub authenticate_api_request {
      
      
        Link Here
      
     | 
  
        
          | 113 | 
              my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; | 
          113 | 
              my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; | 
        
        
          | 114 | 
              my $authorization = $spec->{'x-koha-authorization'}; | 
          114 | 
              my $authorization = $spec->{'x-koha-authorization'}; | 
        
        
          | 115 | 
           | 
          115 | 
           | 
        
          
            
              | 116 | 
                  if (my $oauth = $c->oauth) { | 
              116 | 
                  my $authorization_header = $c->req->headers->authorization;  | 
            
            
              | 117 | 
                      my $clients = C4::Context->config('api_client'); | 
              117 | 
                  if ($authorization_header and $authorization_header =~ /^Bearer /) { | 
            
            
              | 118 | 
                      $clients = [ $clients ] unless ref $clients eq 'ARRAY';  | 
              118 | 
                      if (my $oauth = $c->oauth) { | 
            
            
              | 119 | 
                      my ($client) = grep { $_->{client_id} eq $oauth->{client_id} } @$clients; | 
              119 | 
                          my $clients = C4::Context->config('api_client'); | 
            
            
              | 120 | 
               | 
              120 | 
                          $clients = [ $clients ] unless ref $clients eq 'ARRAY';  | 
            
            
              | 121 | 
                      my $patron = Koha::Patrons->find($client->{patron_id}); | 
              121 | 
                          my ($client) = grep { $_->{client_id} eq $oauth->{client_id} } @$clients; | 
            
            
              | 122 | 
                      my $permissions = $authorization->{'permissions'}; | 
              122 | 
               | 
            
            
              | 123 | 
                      # Check if the patron is authorized  | 
              123 | 
                          my $patron = Koha::Patrons->find($client->{patron_id}); | 
            
            
              | 124 | 
                      if ( haspermission($patron->userid, $permissions)  | 
              124 | 
                          my $permissions = $authorization->{'permissions'}; | 
            
            
              | 125 | 
                          or allow_owner($c, $authorization, $patron)  | 
              125 | 
                          # Check if the patron is authorized  | 
            
            
              | 126 | 
                          or allow_guarantor($c, $authorization, $patron) ) { | 
              126 | 
                          if ( haspermission($patron->userid, $permissions)  | 
            
            
              | 127 | 
               | 
              127 | 
                              or allow_owner($c, $authorization, $patron)  | 
            
            
              | 128 | 
                          validate_query_parameters( $c, $spec );  | 
              128 | 
                              or allow_guarantor($c, $authorization, $patron) ) { | 
            
            
              | 129 | 
               | 
              129 | 
               | 
            
            
              | 130 | 
                          # Everything is ok  | 
              130 | 
                              validate_query_parameters( $c, $spec );  | 
            
            
              | 131 | 
                          return 1;  | 
              131 | 
               | 
            
            
               | 
               | 
              132 | 
                              # Everything is ok  | 
            
            
              | 133 | 
                              return 1;  | 
            
            
              | 134 | 
                          }  | 
            
            
              | 135 | 
               | 
            
            
              | 136 | 
                          Koha::Exceptions::Authorization::Unauthorized->throw(  | 
            
            
              | 137 | 
                              error => "Authorization failure. Missing required permission(s).",  | 
            
            
              | 138 | 
                              required_permissions => $permissions,  | 
            
            
              | 139 | 
                          );  | 
            
        
          | 132 | 
                  }  | 
          140 | 
                  }  | 
        
        
          | 133 | 
           | 
          141 | 
           | 
        
          
            
              | 134 | 
                      Koha::Exceptions::Authorization::Unauthorized->throw(  | 
              142 | 
                      # If we have "Authorization: Bearer" header and oauth authentication  | 
            
            
              | 135 | 
                          error => "Authorization failure. Missing required permission(s).",  | 
              143 | 
                      # failed, do not try other authentication means  | 
            
            
              | 136 | 
                          required_permissions => $permissions,  | 
              144 | 
                      Koha::Exceptions::Authentication::Required->throw(  | 
            
            
               | 
               | 
              145 | 
                          error => 'Authentication failure.'  | 
            
        
          | 137 | 
                  );  | 
          146 | 
                  );  | 
        
        
          | 138 | 
              }  | 
          147 | 
              }  | 
        
        
          | 139 | 
           | 
          148 | 
           | 
        
            
              | 140 | 
              -   | 
               | 
               |