Bugzilla – Attachment 54457 Details for
Bug 14868
REST API: Swagger2-driven permission checking
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 14868: Swagger2-driven Permission checking
Bug-14868-Swagger2-driven-Permission-checking.patch (text/plain), 3.71 KB, created by
Lari Taskula
on 2016-08-15 09:59:58 UTC
(
hide
)
Description:
Bug 14868: Swagger2-driven Permission checking
Filename:
MIME Type:
Creator:
Lari Taskula
Created:
2016-08-15 09:59:58 UTC
Size:
3.71 KB
patch
obsolete
>From 3b4ee5c516f8d11feb6eb7897839126e39a19eb2 Mon Sep 17 00:00:00 2001 >From: Olli-Antti Kivilahti <olli-antti.kivilahti@jns.fi> >Date: Mon, 14 Sep 2015 15:20:20 +0300 >Subject: [PATCH] Bug 14868: Swagger2-driven Permission checking > >Define 'x-koha-permission' for the Swagger2 Operation Object, to automatically >authorize against the required permissions. > >This way we immediately tell the API consumer in the Swagger2-definition, which >permissions are needed to access defined resources. >Also we don't need to maintain permissions in multiple locations and we can build >a smart testing framework to help a lot in creating tests for the new REST API. >--- > Koha/REST/V1.pm | 69 ++++++++++++++++++++++++++++++++++----------- > api/v1/swagger/swagger.json | 1 + > 2 files changed, 53 insertions(+), 17 deletions(-) > >diff --git a/Koha/REST/V1.pm b/Koha/REST/V1.pm >index d9222ae..379c6b4 100644 >--- a/Koha/REST/V1.pm >+++ b/Koha/REST/V1.pm >@@ -18,28 +18,13 @@ package Koha::REST::V1; > use Modern::Perl; > use Mojo::Base 'Mojolicious'; > >-use C4::Auth qw( check_cookie_auth get_session ); >+use C4::Auth qw( check_cookie_auth get_session haspermission ); > use C4::Context; > use Koha::Patrons; > > sub startup { > my $self = shift; > >- my $route = $self->routes->under->to( >- cb => sub { >- my $c = shift; >- >- my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID')); >- if ($status eq "ok") { >- my $session = get_session($sessionID); >- my $user = Koha::Patrons->find($session->param('number')); >- $c->stash('koha.user' => $user); >- } >- >- return 1; >- } >- ); >- > # Force charset=utf8 in Content-Type header for JSON responses > $self->types->type(json => 'application/json; charset=utf8'); > >@@ -49,9 +34,59 @@ sub startup { > } > > $self->plugin(Swagger2 => { >- route => $route, > url => $self->home->rel_file("api/v1/swagger/swagger.min.json"), > }); > } > >+=head3 authenticate_api_request >+ >+Validates authentication and allows access if authorization is not required or >+if authorization is required and user has required permissions to access. >+ >+This subroutine is called before every request to API. >+ >+=cut >+ >+sub authenticate_api_request { >+ my ($next, $c, $action_spec) = @_; >+ >+ my ($session, $user); >+ my $cookie = $c->cookie('CGISESSID'); >+ my ($status, $sessionID) = check_cookie_auth($cookie); >+ if ($status eq "ok") { >+ $session = get_session($sessionID); >+ $user = Koha::Patrons->find($session->param('number')); >+ $c->stash('koha.user' => $user); >+ } >+ else { >+ return $c->render_swagger( >+ { error => "Authentication failure." }, >+ {}, >+ 401 >+ ) if $cookie; >+ } >+ >+ if ($action_spec->{'x-koha-permission'}) { >+ return $c->render_swagger( >+ { error => "Authentication required." }, >+ {}, >+ 401 >+ ) unless $user; >+ >+ if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) { >+ return $next->($c); >+ } >+ else { >+ return $c->render_swagger( >+ { error => "Authorization failure. Missing required permission(s)." }, >+ {}, >+ 403 >+ ); >+ } >+ } >+ else { >+ return $next->($c); >+ } >+} >+ > 1; >diff --git a/api/v1/swagger/swagger.json b/api/v1/swagger/swagger.json >index 249e71b..75fe161 100644 >--- a/api/v1/swagger/swagger.json >+++ b/api/v1/swagger/swagger.json >@@ -13,6 +13,7 @@ > } > }, > "basePath": "/api/v1", >+ "x-mojo-around-action": "Koha::REST::V1::authenticate_api_request", > "paths": { > "$ref": "paths.json" > }, >-- >1.9.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14868
:
42761
|
52577
|
52578
|
52579
|
52592
|
52593
|
52594
|
52602
|
52603
|
52604
|
52963
|
52964
|
52965
|
52966
|
52967
|
52981
|
52992
|
52993
|
52994
|
52995
|
52996
|
54457
|
54458
|
54459
|
54631
|
54632
|
54633
|
54765
|
54766
|
54767
|
54770
|
54771
|
54894
|
54895
|
54896
|
54897
|
55084
|
55085
|
55086
|
55087
|
55088
|
55089
|
55099
|
55100
|
55101
|
55102
|
55103
|
55104
|
55105