|
Lines 326-331
sub allow_guarantor {
Link Here
|
| 326 |
} |
326 |
} |
| 327 |
} |
327 |
} |
| 328 |
|
328 |
|
|
|
329 |
=head3 check_resource_ownership |
| 330 |
|
| 331 |
For endpoints under /api/v1/public namespace, you can allow API consumers to |
| 332 |
access their own resources without having librarian permissions. |
| 333 |
|
| 334 |
See C<allow_owner()> for documentation on usage in OpenAPI spec. |
| 335 |
|
| 336 |
In order to authorize API consumer to their own resources, you must define a |
| 337 |
method called C<owner_authorization> in controller class. This subroutine |
| 338 |
usually reads request parameters and compares them to the Koha::Patron stored |
| 339 |
in C<$c->stash('koha.user')>. |
| 340 |
|
| 341 |
=cut |
| 342 |
|
| 343 |
sub check_resource_ownership { |
| 344 |
my ($c, $user) = @_; |
| 345 |
|
| 346 |
return 0 if not $c or not $user; |
| 347 |
my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; |
| 348 |
my $xmojoto = $spec->{'x-mojo-to'}; |
| 349 |
if ( $xmojoto =~ /([A-Za-z0-9:]+)#([A-Za-z0-9_]+)/ ) { |
| 350 |
my $controller = "Koha::REST::V1::$1"; |
| 351 |
if ( ! Module::Load::Conditional::can_load( |
| 352 |
modules => {$controller => undef} )) { |
| 353 |
return 0; |
| 354 |
} |
| 355 |
else { |
| 356 |
if (my $owner_auth = $controller->can('owner_authorization')) { |
| 357 |
return $owner_auth->( |
| 358 |
$c, $2, $user, $spec->{'x-koha-authorization'} |
| 359 |
) ? 1 : 0; |
| 360 |
} |
| 361 |
} |
| 362 |
} |
| 363 |
|
| 364 |
return 0; |
| 365 |
} |
| 366 |
|
| 329 |
=head3 check_object_ownership |
367 |
=head3 check_object_ownership |
| 330 |
|
368 |
|
| 331 |
Determines ownership of an object from request parameters. |
369 |
Determines ownership of an object from request parameters. |
| 332 |
- |
|
|