Lines 326-331
sub allow_guarantor {
Link Here
|
326 |
} |
326 |
} |
327 |
} |
327 |
} |
328 |
|
328 |
|
|
|
329 |
=head3 check_resource_ownership |
330 |
|
331 |
For endpoints under /api/v1/public namespace, you can allow API consumers to |
332 |
access their own resources without having librarian permissions. |
333 |
|
334 |
See C<allow_owner()> for documentation on usage in OpenAPI spec. |
335 |
|
336 |
In order to authorize API consumer to their own resources, you must define a |
337 |
method called C<owner_authorization> in controller class. This subroutine |
338 |
usually reads request parameters and compares them to the Koha::Patron stored |
339 |
in C<$c->stash('koha.user')>. |
340 |
|
341 |
=cut |
342 |
|
343 |
sub check_resource_ownership { |
344 |
my ($c, $user) = @_; |
345 |
|
346 |
return 0 if not $c or not $user; |
347 |
my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; |
348 |
my $xmojoto = $spec->{'x-mojo-to'}; |
349 |
if ( $xmojoto =~ /([A-Za-z0-9:]+)#([A-Za-z0-9_]+)/ ) { |
350 |
my $controller = "Koha::REST::V1::$1"; |
351 |
if ( ! Module::Load::Conditional::can_load( |
352 |
modules => {$controller => undef} )) { |
353 |
return 0; |
354 |
} |
355 |
else { |
356 |
if (my $owner_auth = $controller->can('owner_authorization')) { |
357 |
return $owner_auth->( |
358 |
$c, $2, $user, $spec->{'x-koha-authorization'} |
359 |
) ? 1 : 0; |
360 |
} |
361 |
} |
362 |
} |
363 |
|
364 |
return 0; |
365 |
} |
366 |
|
329 |
=head3 check_object_ownership |
367 |
=head3 check_object_ownership |
330 |
|
368 |
|
331 |
Determines ownership of an object from request parameters. |
369 |
Determines ownership of an object from request parameters. |
332 |
- |
|
|