|
Lines 113-118
if authorization is required and user has required permissions to access.
Link Here
|
| 113 |
sub authenticate_api_request { |
113 |
sub authenticate_api_request { |
| 114 |
my ( $c ) = @_; |
114 |
my ( $c ) = @_; |
| 115 |
|
115 |
|
|
|
116 |
my $user; |
| 117 |
|
| 116 |
my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; |
118 |
my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; |
| 117 |
my $authorization = $spec->{'x-koha-authorization'}; |
119 |
my $authorization = $spec->{'x-koha-authorization'}; |
| 118 |
|
120 |
|
|
Lines 138-206
sub authenticate_api_request {
Link Here
|
| 138 |
); |
140 |
); |
| 139 |
|
141 |
|
| 140 |
if ($valid_token) { |
142 |
if ($valid_token) { |
| 141 |
my $patron_id = Koha::ApiKeys->find( $valid_token->{client_id} )->patron_id; |
143 |
my $patron_id = Koha::ApiKeys->find( $valid_token->{client_id} )->patron_id; |
| 142 |
my $patron = Koha::Patrons->find($patron_id); |
144 |
$user = Koha::Patrons->find($patron_id); |
| 143 |
$c->stash('koha.user' => $patron); |
145 |
} |
| 144 |
|
146 |
else { |
| 145 |
my $permissions = $authorization->{'permissions'}; |
147 |
# If we have "Authorization: Bearer" header and oauth authentication |
| 146 |
# Check if the patron is authorized |
148 |
# failed, do not try other authentication means |
| 147 |
if ( haspermission($patron->userid, $permissions) |
149 |
Koha::Exceptions::Authentication::Required->throw( |
| 148 |
or allow_owner($c, $authorization, $patron) |
150 |
error => 'Authentication failure.' |
| 149 |
or allow_guarantor($c, $authorization, $patron) ) { |
|
|
| 150 |
|
| 151 |
validate_query_parameters( $c, $spec ); |
| 152 |
|
| 153 |
# Everything is ok |
| 154 |
return 1; |
| 155 |
} |
| 156 |
|
| 157 |
Koha::Exceptions::Authorization::Unauthorized->throw( |
| 158 |
error => "Authorization failure. Missing required permission(s).", |
| 159 |
required_permissions => $permissions, |
| 160 |
); |
151 |
); |
| 161 |
} |
152 |
} |
| 162 |
|
|
|
| 163 |
# If we have "Authorization: Bearer" header and oauth authentication |
| 164 |
# failed, do not try other authentication means |
| 165 |
Koha::Exceptions::Authentication::Required->throw( |
| 166 |
error => 'Authentication failure.' |
| 167 |
); |
| 168 |
} |
| 169 |
|
| 170 |
my $cookie = $c->cookie('CGISESSID'); |
| 171 |
my ($session, $user); |
| 172 |
# Mojo doesn't use %ENV the way CGI apps do |
| 173 |
# Manually pass the remote_address to check_auth_cookie |
| 174 |
my $remote_addr = $c->tx->remote_address; |
| 175 |
my ($status, $sessionID) = check_cookie_auth( |
| 176 |
$cookie, undef, |
| 177 |
{ remote_addr => $remote_addr }); |
| 178 |
if ($status eq "ok") { |
| 179 |
$session = get_session($sessionID); |
| 180 |
$user = Koha::Patrons->find($session->param('number')); |
| 181 |
$c->stash('koha.user' => $user); |
| 182 |
} |
| 183 |
elsif ($status eq "maintenance") { |
| 184 |
Koha::Exceptions::UnderMaintenance->throw( |
| 185 |
error => 'System is under maintenance.' |
| 186 |
); |
| 187 |
} |
153 |
} |
| 188 |
elsif ($status eq "expired" and $authorization) { |
154 |
else { |
| 189 |
Koha::Exceptions::Authentication::SessionExpired->throw( |
155 |
|
| 190 |
error => 'Session has been expired.' |
156 |
my $cookie = $c->cookie('CGISESSID'); |
| 191 |
); |
157 |
|
| 192 |
} |
158 |
# Mojo doesn't use %ENV the way CGI apps do |
| 193 |
elsif ($status eq "failed" and $authorization) { |
159 |
# Manually pass the remote_address to check_auth_cookie |
| 194 |
Koha::Exceptions::Authentication::Required->throw( |
160 |
my $remote_addr = $c->tx->remote_address; |
| 195 |
error => 'Authentication failure.' |
161 |
my ($status, $sessionID) = check_cookie_auth( |
| 196 |
); |
162 |
$cookie, undef, |
| 197 |
} |
163 |
{ remote_addr => $remote_addr }); |
| 198 |
elsif ($authorization) { |
164 |
if ($status eq "ok") { |
| 199 |
Koha::Exceptions::Authentication->throw( |
165 |
my $session = get_session($sessionID); |
| 200 |
error => 'Unexpected authentication status.' |
166 |
$user = Koha::Patrons->find($session->param('number')); |
| 201 |
); |
167 |
# $c->stash('koha.user' => $user); |
|
|
168 |
} |
| 169 |
elsif ($status eq "maintenance") { |
| 170 |
Koha::Exceptions::UnderMaintenance->throw( |
| 171 |
error => 'System is under maintenance.' |
| 172 |
); |
| 173 |
} |
| 174 |
elsif ($status eq "expired" and $authorization) { |
| 175 |
Koha::Exceptions::Authentication::SessionExpired->throw( |
| 176 |
error => 'Session has been expired.' |
| 177 |
); |
| 178 |
} |
| 179 |
elsif ($status eq "failed" and $authorization) { |
| 180 |
Koha::Exceptions::Authentication::Required->throw( |
| 181 |
error => 'Authentication failure.' |
| 182 |
); |
| 183 |
} |
| 184 |
elsif ($authorization) { |
| 185 |
Koha::Exceptions::Authentication->throw( |
| 186 |
error => 'Unexpected authentication status.' |
| 187 |
); |
| 188 |
} |
| 202 |
} |
189 |
} |
| 203 |
|
190 |
|
|
|
191 |
$c->stash('koha.user' => $user); |
| 192 |
|
| 204 |
# We do not need any authorization |
193 |
# We do not need any authorization |
| 205 |
unless ($authorization) { |
194 |
unless ($authorization) { |
| 206 |
# Check the parameters |
195 |
# Check the parameters |
|
Lines 225-230
sub authenticate_api_request {
Link Here
|
| 225 |
required_permissions => $permissions, |
214 |
required_permissions => $permissions, |
| 226 |
); |
215 |
); |
| 227 |
} |
216 |
} |
|
|
217 |
|
| 228 |
sub validate_query_parameters { |
218 |
sub validate_query_parameters { |
| 229 |
my ( $c, $action_spec ) = @_; |
219 |
my ( $c, $action_spec ) = @_; |
| 230 |
|
220 |
|
| 231 |
- |
|
|