From 515b7dc68a33e69fc0ebcb6004547483cd693fab Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Thu, 14 Apr 2022 13:47:06 +0100 Subject: [PATCH] Bug 30536: Remove validation overhead With the introduction of proper validation of collection headers in OpenAPI we no longer need to do our own validation here. This patch removes the early validation of x-koha-embed headers in preference to letting OpenAPI do it once and only once instead. --- Koha/REST/Plugin/Query.pm | 32 ++++++++++---------------------- Koha/REST/V1/Auth.pm | 2 +- 2 files changed, 11 insertions(+), 23 deletions(-) diff --git a/Koha/REST/Plugin/Query.pm b/Koha/REST/Plugin/Query.pm index f14fa6fdc9..de8b664806 100644 --- a/Koha/REST/Plugin/Query.pm +++ b/Koha/REST/Plugin/Query.pm @@ -229,41 +229,29 @@ Merges parameters from $q_params into $filtered_params. =head3 stash_embed - $c->stash_embed( $c->match->endpoint->pattern->defaults->{'openapi.op_spec'} ); + $c->stash_embed( ); =cut $app->helper( 'stash_embed' => sub { - my ( $c, $args ) = @_; - - my $spec = $args->{spec} // {}; + my ( $c ) = @_; - my $embed_spec; - for my $param (@{$spec->{parameters}}) { - next unless $param->{name} eq 'x-koha-embed'; - $embed_spec = $param->{items}->{enum}; - } + # FIXME: This routine is currently called from Auth, and only Auth, + # and is prior to OpenAPI validation. As such, we cannot use the + # validated output of OpenAPI yet and thus have to fetch and split + # the headers ourselves. Validation takes place as the first step in + # the controllers and will varify the header again at this point. my $embed_header = $c->req->headers->header('x-koha-embed'); - - Koha::Exceptions::BadParameter->throw("Embedding objects is not allowed on this endpoint.") - if $embed_header and !defined $embed_spec; - - if ( $embed_header ) { + if ($embed_header) { my $THE_embed = {}; foreach my $embed_req ( split /\s*,\s*/, $embed_header ) { - my $matches = grep {lc $_ eq lc $embed_req} @{ $embed_spec }; - - Koha::Exceptions::BadParameter->throw( - error => 'Embeding '.$embed_req. ' is not authorised. Check your x-koha-embed headers or remove it.' - ) unless $matches; - - _merge_embed( _parse_embed($embed_req), $THE_embed); + _merge_embed( _parse_embed($embed_req), $THE_embed ); } $c->stash( 'koha.embed' => $THE_embed ) - if $THE_embed; + if $THE_embed; } return $c; diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm index 7bbf97fc05..d535770f6e 100644 --- a/Koha/REST/V1/Auth.pm +++ b/Koha/REST/V1/Auth.pm @@ -157,7 +157,7 @@ sub authenticate_api_request { # TODO: remove the latter 'openapi.op_spec' if minimum version is bumped to at least 1.17. my $spec = $c->openapi->spec || $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; - $c->stash_embed({ spec => $spec }); + $c->stash_embed(); $c->stash_overrides(); my $cookie_auth = 0; -- 2.20.1