Attachment 43990 Details for Bug 13799 – [PASSED QA] Bug 13799: Add cookie-based authentication to REST API

[patch] [PASSED QA] Bug 13799: Add cookie-based authentication to REST API

PASSED-QA-Bug-13799-Add-cookie-based-authenticatio.patch (text/plain), 3.72 KB, created by Kyle M Hall (khall) on 2015-10-26 13:38:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kyle M Hall (khall)

Created: 2015-10-26 13:38:14 UTC

Size: 3.72 KB

patch

obsolete

>From 870475409f3722dd3a3550841bdccbea995b0fd1 Mon Sep 17 00:00:00 2001
>From: Julian Maurice <julian.maurice@biblibre.com>
>Date: Mon, 31 Aug 2015 17:00:52 +0200
>Subject: [PATCH] [PASSED QA] Bug 13799: Add cookie-based authentication to REST API
>
>Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
>Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>
>Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
>---
> Koha/REST/V1.pm           |   14 +++++++++++---
> Koha/REST/V1/Borrowers.pm |   22 ++++++++++++++++++----
> api/v1/swagger.json       |   12 ++++++++++++
> 3 files changed, 41 insertions(+), 7 deletions(-)
>
>diff --git a/Koha/REST/V1.pm b/Koha/REST/V1.pm
>index 39cdab9..7d7102d 100644
>--- a/Koha/REST/V1.pm
>+++ b/Koha/REST/V1.pm
>@@ -3,15 +3,23 @@ package Koha::REST::V1;
> use Modern::Perl;
> use Mojo::Base 'Mojolicious';
> 
>+use C4::Auth qw( check_cookie_auth get_session );
>+use Koha::Borrowers;
>+
> sub startup {
>     my $self = shift;
> 
>     my $route = $self->routes->under->to(
>         cb => sub {
>             my $c = shift;
>-            my $user = $c->param('user');
>-            # Do the authentication stuff here...
>-            $c->stash('user', $user);
>+
>+            my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'));
>+            if ($status eq "ok") {
>+                my $session = get_session($sessionID);
>+                my $user = Koha::Borrowers->find($session->param('number'));
>+                $c->stash('koha.user' => $user);
>+            }
>+
>             return 1;
>         }
>     );
>diff --git a/Koha/REST/V1/Borrowers.pm b/Koha/REST/V1/Borrowers.pm
>index b58ad2a..8857df4 100644
>--- a/Koha/REST/V1/Borrowers.pm
>+++ b/Koha/REST/V1/Borrowers.pm
>@@ -4,11 +4,17 @@ use Modern::Perl;
> 
> use Mojo::Base 'Mojolicious::Controller';
> 
>+use C4::Auth qw( haspermission );
> use Koha::Borrowers;
> 
> sub list_borrowers {
>     my ($c, $args, $cb) = @_;
> 
>+    my $user = $c->stash('koha.user');
>+    unless ($user && haspermission($user->userid, {borrowers => 1})) {
>+        return $c->$cb({error => "You don't have the required permission"}, 403);
>+    }
>+
>     my $borrowers = Koha::Borrowers->search;
> 
>     $c->$cb($borrowers->unblessed, 200);
>@@ -17,13 +23,21 @@ sub list_borrowers {
> sub get_borrower {
>     my ($c, $args, $cb) = @_;
> 
>-    my $borrower = Koha::Borrowers->find($args->{borrowernumber});
>+    my $user = $c->stash('koha.user');
> 
>-    if ($borrower) {
>-        return $c->$cb($borrower->unblessed, 200);
>+    unless ( $user
>+        && ( $user->borrowernumber == $args->{borrowernumber}
>+            || haspermission($user->userid, {borrowers => 1}) ) )
>+    {
>+        return $c->$cb({error => "You don't have the required permission"}, 403);
>+    }
>+
>+    my $borrower = Koha::Borrowers->find($args->{borrowernumber});
>+    unless ($borrower) {
>+        return $c->$cb({error => "Borrower not found"}, 404);
>     }
> 
>-    $c->$cb({error => "Borrower not found"}, 404);
>+    return $c->$cb($borrower->unblessed, 200);
> }
> 
> 1;
>diff --git a/api/v1/swagger.json b/api/v1/swagger.json
>index 9672f15..a20cb20 100644
>--- a/api/v1/swagger.json
>+++ b/api/v1/swagger.json
>@@ -31,6 +31,12 @@
>                 "$ref": "#/definitions/borrower"
>               }
>             }
>+          },
>+          "403": {
>+            "description": "Access forbidden",
>+            "schema": {
>+              "$ref": "#/definitions/error"
>+            }
>           }
>         }
>       }
>@@ -55,6 +61,12 @@
>               "$ref": "#/definitions/borrower"
>             }
>           },
>+          "403": {
>+            "description": "Access forbidden",
>+            "schema": {
>+              "$ref": "#/definitions/error"
>+            }
>+          },
>           "404": {
>             "description": "Borrower not found",
>             "schema": {
>-- 
>1.7.2.5

Actions: View | Diff | Splinter Review

Attachments on bug 13799: 36700 | 36705 | 36938 | 36941 | 37119 | 37132 | 37172 | 38246 | 39156 | 39158 | 39159 | 39160 | 39161 | 39162 | 39163 | 39164 | 40088 | 40092 | 40093 | 40094 | 40098 | 40099 | 40101 | 40140 | 40141 | 40142 | 40463 | 40464 | 40465 | 40466 | 40467 | 40468 | 40469 | 40470 | 40471 | 40551 | 40552 | 40553 | 40554 | 40560 | 40561 | 40584 | 40585 | 40586 | 40587 | 40616 | 40617 | 40618 | 40619 | 41160 | 41161 | 41162 | 41268 | 41269 | 41270 | 41271 | 41272 | 41273 | 41274 | 41320 | 41321 | 41326 | 41327 | 41328 | 41329 | 41330 | 41331 | 41538 | 41539 | 41540 | 41541 | 41542 | 41543 | 41547 | 41554 | 42044 | 42085 | 42086 | 42123 | 42518 | 42766 | 42768 | 42801 | 42874 | 42875 | 42876 | 42877 | 42878 | 43186 | 43187 | 43189 | 43190 | 43191 | 43192 | 43204 | 43205 | 43206 | 43207 | 43208 | 43209 | 43210 | 43211 | 43212 | 43213 | 43214 | 43980 | 43981 | 43987 | 43989 | 43990 | 43991 | 43992 | 43993 | 43994 | 43995 | 43996 | 43997 | 43998 | 43999 | 44000 | 44001 | 44185 | 44285 | 44313 | 44375 | 44376 | 44377 | 44378 | 44379 | 44380 | 44381 | 44382 | 44383 | 44384 | 44385