View | Details | Raw Unified | Return to bug 24067
Collapse All | Expand All

(-)a/Koha/REST/V1/Auth.pm (-1 / +38 lines)
Lines 326-331 sub allow_guarantor { Link Here
326
    }
326
    }
327
}
327
}
328
328
329
=head3 check_resource_ownership
330
331
For endpoints under /api/v1/public namespace, you can allow API consumers to
332
access their own resources without having librarian permissions.
333
334
See C<allow_owner()> for documentation on usage in OpenAPI spec.
335
336
In order to authorize API consumer to their own resources, you must define a
337
method called C<owner_authorization> in controller class. This subroutine
338
usually reads request parameters and compares them to the Koha::Patron stored
339
in C<$c->stash('koha.user')>.
340
341
=cut
342
343
sub check_resource_ownership {
344
    my ($c, $user) = @_;
345
346
    return 0 if not $c or not $user;
347
    my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'};
348
    my $xmojoto = $spec->{'x-mojo-to'};
349
    if ( $xmojoto =~ /([A-Za-z0-9:]+)#([A-Za-z0-9_]+)/ ) {
350
        my $controller = "Koha::REST::V1::$1";
351
        if ( ! Module::Load::Conditional::can_load(
352
                    modules => {$controller => undef} )) {
353
            return 0;
354
        }
355
        else {
356
            if (my $owner_auth = $controller->can('owner_authorization')) {
357
                return $owner_auth->(
358
                    $c, $2, $user, $spec->{'x-koha-authorization'}
359
                ) ? 1 : 0;
360
            }
361
        }
362
    }
363
364
    return 0;
365
}
366
329
=head3 check_object_ownership
367
=head3 check_object_ownership
330
368
331
Determines ownership of an object from request parameters.
369
Determines ownership of an object from request parameters.
332
- 

Return to bug 24067