Attachment 42518 Details for Bug 13799 – Bug 13799 - Swagger2-driven Permission checking

[patch] Bug 13799 - Swagger2-driven Permission checking

Bug-13799---Swagger2-driven-Permission-checking.patch (text/plain), 4.25 KB, created by Olli-Antti Kivilahti on 2015-09-14 12:36:35 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Olli-Antti Kivilahti

Created: 2015-09-14 12:36:35 UTC

Size: 4.25 KB

patch

obsolete

>From dfcb5fc20bd8ca444326936229f445f9b29383c6 Mon Sep 17 00:00:00 2001
>From: Olli-Antti Kivilahti <olli-antti.kivilahti@jns.fi>
>Date: Mon, 14 Sep 2015 15:20:20 +0300
>Subject: [PATCH] Bug 13799 - Swagger2-driven Permission checking
>
>A hasty downgrade from 13920, utilizing new features implemented by the
>Mojolicious::Plugin::Swagger2-author, to make it possible to implement more
>complex authentication/authorization scenarios with the Plugin.
>
>Define 'x-koha-permission' for the Swagger2 Operation Object, to automatically
>authorize against the required permissions.
>
>This way we immediately tell the API consumer in the Swagger2-definition, which
>permissions are needed to access defined resources.
>Also we don't need to maintain permissions in multiple locations and we can build
>a smart testing framework to help a lot in creating tests for the new REST API.
>---
> Koha/REST/V1.pm     | 62 ++++++++++++++++++++++++++++++++++++++---------------
> api/v1/swagger.json |  7 ++++++
> 2 files changed, 52 insertions(+), 17 deletions(-)
>
>diff --git a/Koha/REST/V1.pm b/Koha/REST/V1.pm
>index 7d7102d..9dad30c 100644
>--- a/Koha/REST/V1.pm
>+++ b/Koha/REST/V1.pm
>@@ -3,34 +3,62 @@ package Koha::REST::V1;
> use Modern::Perl;
> use Mojo::Base 'Mojolicious';
> 
>-use C4::Auth qw( check_cookie_auth get_session );
>+use C4::Auth qw( check_cookie_auth get_session haspermission );
> use Koha::Borrowers;
> 
> sub startup {
>     my $self = shift;
> 
>-    my $route = $self->routes->under->to(
>-        cb => sub {
>-            my $c = shift;
>-
>-            my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'));
>-            if ($status eq "ok") {
>-                my $session = get_session($sessionID);
>-                my $user = Koha::Borrowers->find($session->param('number'));
>-                $c->stash('koha.user' => $user);
>-            }
>-
>-            return 1;
>-        }
>-    );
>-
>     # Force charset=utf8 in Content-Type header for JSON responses
>     $self->types->type(json => 'application/json; charset=utf8');
> 
>     $self->plugin(Swagger2 => {
>-        route => $route,
>         url => $self->home->rel_file("api/v1/swagger.json"),
>     });
> }
> 
>+sub authenticate_api_request {
>+    my ($next, $c, $action_spec) = @_;
>+
>+    # Go to the action if the Authorization header is valid
>+    my ($session, $user);
>+    my $cookie = $c->tx->req->cookie('CGISESSID');
>+    my ($status, $sessionID) = check_cookie_auth($cookie->value) if $cookie;
>+    if ($status eq "ok") {
>+        $session = get_session($sessionID);
>+        $user = Koha::Borrowers->find($session->param('number'));
>+        $c->stash('koha.user' => $user);
>+    }
>+    else {
>+        return $c->render_swagger(
>+            {errors => [{message => "Invalid authorization key", path => "/"}]},
>+            {},
>+            401
>+        );
>+    }
>+
>+    if ($action_spec->{'x-koha-permission'}) {
>+        if (C4::Auth::haspermission($user, $action_spec->{'x-koha-permission'})) {
>+            return $next->($c);
>+        }
>+        else {
>+            return $c->render_swagger(
>+                {errors => [{message => "No permission", path => "/"}]},
>+                {},
>+                401
>+            );
>+        }
>+    }
>+    else {
>+        return $next->($c);
>+    }
>+
>+    #If everything else fails, DO NOT authenticate by default!
>+    return $c->render_swagger(
>+        {errors => [{message => "Something bad happened when authenticating request", path => "/"}]},
>+        {},
>+        500
>+    );
>+}
>+
> 1;
>diff --git a/api/v1/swagger.json b/api/v1/swagger.json
>index a20cb20..d297eb0 100644
>--- a/api/v1/swagger.json
>+++ b/api/v1/swagger.json
>@@ -13,10 +13,14 @@
>     }
>   },
>   "basePath": "/api/v1",
>+  "x-mojo-around-action": "Koha::REST::V1::authenticate_api_request",
>   "paths": {
>     "/borrowers": {
>       "get": {
>         "x-mojo-controller": "Koha::REST::V1::Borrowers",
>+        "x-koha-permission": {
>+          "borrowers": "1"
>+        },
>         "operationId": "listBorrowers",
>         "tags": ["borrowers"],
>         "produces": [
>@@ -44,6 +48,9 @@
>     "/borrowers/{borrowernumber}": {
>       "get": {
>         "x-mojo-controller": "Koha::REST::V1::Borrowers",
>+        "x-koha-permission": {
>+          "borrowers": "1"
>+        },
>         "operationId": "getBorrower",
>         "tags": ["borrowers"],
>         "parameters": [
>-- 
>1.9.1

Actions: View | Diff | Splinter Review

Attachments on bug 13799: 36700 | 36705 | 36938 | 36941 | 37119 | 37132 | 37172 | 38246 | 39156 | 39158 | 39159 | 39160 | 39161 | 39162 | 39163 | 39164 | 40088 | 40092 | 40093 | 40094 | 40098 | 40099 | 40101 | 40140 | 40141 | 40142 | 40463 | 40464 | 40465 | 40466 | 40467 | 40468 | 40469 | 40470 | 40471 | 40551 | 40552 | 40553 | 40554 | 40560 | 40561 | 40584 | 40585 | 40586 | 40587 | 40616 | 40617 | 40618 | 40619 | 41160 | 41161 | 41162 | 41268 | 41269 | 41270 | 41271 | 41272 | 41273 | 41274 | 41320 | 41321 | 41326 | 41327 | 41328 | 41329 | 41330 | 41331 | 41538 | 41539 | 41540 | 41541 | 41542 | 41543 | 41547 | 41554 | 42044 | 42085 | 42086 | 42123 | 42518 | 42766 | 42768 | 42801 | 42874 | 42875 | 42876 | 42877 | 42878 | 43186 | 43187 | 43189 | 43190 | 43191 | 43192 | 43204 | 43205 | 43206 | 43207 | 43208 | 43209 | 43210 | 43211 | 43212 | 43213 | 43214 | 43980 | 43981 | 43987 | 43989 | 43990 | 43991 | 43992 | 43993 | 43994 | 43995 | 43996 | 43997 | 43998 | 43999 | 44000 | 44001 | 44185 | 44285 | 44313 | 44375 | 44376 | 44377 | 44378 | 44379 | 44380 | 44381 | 44382 | 44383 | 44384 | 44385