View | Details | Raw Unified | Return to bug 13920
Collapse All | Expand All

(-)a/Koha/ApiTimestamp.pm (+46 lines)
Line 0 Link Here
1
package Koha::ApiTimestamp;
2
3
# Copyright BibLibre 2015
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 3 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along
17
# with Koha; if not, write to the Free Software Foundation, Inc.,
18
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19
20
use Modern::Perl;
21
22
use Carp;
23
24
use Koha::Database;
25
26
use base qw(Koha::Object);
27
28
=head1 NAME
29
30
Koha::ApiTimestamp - Koha API Timestamp Object class
31
32
=head1 API
33
34
=head2 Class Methods
35
36
=cut
37
38
=head3 type
39
40
=cut
41
42
sub type {
43
    return 'ApiTimestamp';
44
}
45
46
1;
(-)a/Koha/ApiTimestamps.pm (+58 lines)
Line 0 Link Here
1
package Koha::ApiTimestamps;
2
3
# Copyright BibLibre 2015
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 3 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along
17
# with Koha; if not, write to the Free Software Foundation, Inc.,
18
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19
20
use Modern::Perl;
21
22
use Carp;
23
24
use Koha::Database;
25
26
use Koha::Borrower;
27
28
use base qw(Koha::Objects);
29
30
=head1 NAME
31
32
Koha::ApiTimestamps - Koha API Timestamps Object class
33
34
=head1 API
35
36
=head2 Class Methods
37
38
=cut
39
40
=head3 type
41
42
=cut
43
44
sub type {
45
    return 'ApiTimestamp';
46
}
47
48
sub object_class {
49
    return 'Koha::ApiTimestamp';
50
}
51
52
=head1 AUTHOR
53
54
Kyle M Hall <kyle@bywatersolutions.com>
55
56
=cut
57
58
1;
(-)a/Koha/REST/V1.pm (-3 / +59 lines)
Lines 3-17 package Koha::REST::V1; Link Here
3
use Modern::Perl;
3
use Modern::Perl;
4
use Mojo::Base 'Mojolicious';
4
use Mojo::Base 'Mojolicious';
5
5
6
use Digest::SHA qw(hmac_sha256_hex);
7
8
use Koha::Borrower;
9
use Koha::Borrowers;
10
use Koha::ApiKey;
11
use Koha::ApiKeys;
12
use Koha::ApiTimestamp;
13
use Koha::ApiTimestamps;
14
6
sub startup {
15
sub startup {
7
    my $self = shift;
16
    my $self = shift;
8
17
9
    my $route = $self->routes->under->to(
18
    my $route = $self->routes->under->to(
10
        cb => sub {
19
        cb => sub {
11
            my $c = shift;
20
            my $c = shift;
12
            my $user = $c->param('user');
21
            my $req_username = $c->req->headers->header('X-Koha-Username');
13
            # Do the authentication stuff here...
22
            my $req_timestamp = $c->req->headers->header('X-Koha-Timestamp');
14
            $c->stash('user', $user);
23
            my $req_signature = $c->req->headers->header('X-Koha-Signature');
24
            my $req_method = $c->req->method;
25
            my $req_url = '/' . $c->req->url->path_query;
26
27
            # "Anonymous" mode
28
            return 1
29
              unless ( defined($req_username)
30
                or defined($req_timestamp)
31
                or defined($req_signature) );
32
33
            my $borrower = Koha::Borrowers->find({userid => $req_username});
34
35
            my @apikeys = Koha::ApiKeys->search({
36
                borrowernumber => $borrower->borrowernumber,
37
                active => 1,
38
            });
39
40
            my $message = "$req_method $req_url $req_username $req_timestamp";
41
            my $signature = '';
42
            foreach my $apikey (@apikeys) {
43
                $signature = hmac_sha256_hex($message, $apikey->api_key);
44
45
                last if $signature eq $req_signature;
46
            }
47
48
            unless ($signature eq $req_signature) {
49
                $c->res->code(403);
50
                $c->render(json => { error => "Authentication failed" });
51
                return;
52
            }
53
54
            my $api_timestamp = Koha::ApiTimestamps->find($borrower->borrowernumber);
55
            my $timestamp = $api_timestamp ? $api_timestamp->timestamp : 0;
56
            unless ($timestamp < $req_timestamp) {
57
                $c->res->code(403);
58
                $c->render(json => { error => "Bad timestamp" });
59
                return;
60
            }
61
62
            unless ($api_timestamp) {
63
                $api_timestamp = new Koha::ApiTimestamp;
64
                $api_timestamp->borrowernumber($borrower->borrowernumber);
65
            }
66
            $api_timestamp->timestamp($req_timestamp);
67
            $api_timestamp->store;
68
69
            # Authentication succeeded, store authenticated user in stash
70
            $c->stash('user', $borrower);
15
            return 1;
71
            return 1;
16
        }
72
        }
17
    );
73
    );
(-)a/Koha/Schema/Result/ApiTimestamp.pm (+81 lines)
Line 0 Link Here
1
use utf8;
2
package Koha::Schema::Result::ApiTimestamp;
3
4
# Created by DBIx::Class::Schema::Loader
5
# DO NOT MODIFY THE FIRST PART OF THIS FILE
6
7
=head1 NAME
8
9
Koha::Schema::Result::ApiTimestamp
10
11
=cut
12
13
use strict;
14
use warnings;
15
16
use base 'DBIx::Class::Core';
17
18
=head1 TABLE: C<api_timestamps>
19
20
=cut
21
22
__PACKAGE__->table("api_timestamps");
23
24
=head1 ACCESSORS
25
26
=head2 borrowernumber
27
28
  data_type: 'integer'
29
  is_foreign_key: 1
30
  is_nullable: 0
31
32
=head2 timestamp
33
34
  data_type: 'bigint'
35
  is_nullable: 1
36
37
=cut
38
39
__PACKAGE__->add_columns(
40
  "borrowernumber",
41
  { data_type => "integer", is_foreign_key => 1, is_nullable => 0 },
42
  "timestamp",
43
  { data_type => "bigint", is_nullable => 1 },
44
);
45
46
=head1 PRIMARY KEY
47
48
=over 4
49
50
=item * L</borrowernumber>
51
52
=back
53
54
=cut
55
56
__PACKAGE__->set_primary_key("borrowernumber");
57
58
=head1 RELATIONS
59
60
=head2 borrowernumber
61
62
Type: belongs_to
63
64
Related object: L<Koha::Schema::Result::Borrower>
65
66
=cut
67
68
__PACKAGE__->belongs_to(
69
  "borrowernumber",
70
  "Koha::Schema::Result::Borrower",
71
  { borrowernumber => "borrowernumber" },
72
  { is_deferrable => 1, on_delete => "CASCADE", on_update => "CASCADE" },
73
);
74
75
76
# Created by DBIx::Class::Schema::Loader v0.07025 @ 2015-03-24 08:27:29
77
# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:FfKz14uY/UgVOWcF4T5J8A
78
79
80
# You can replace this text with custom code or comments, and it will be preserved on regeneration
81
1;
(-)a/api/v1/doc/css/screen.css (-1 / +4 lines)
Lines 1216-1222 Link Here
1216
  margin: 0 10px 0 0;
1216
  margin: 0 10px 0 0;
1217
}
1217
}
1218
.swagger-section #header form#api_selector .input input#input_apiKey {
1218
.swagger-section #header form#api_selector .input input#input_apiKey {
1219
  width: 200px;
1219
  width: 100px;
1220
}
1221
.swagger-section #header form#api_selector .input input#input_username {
1222
  width: 100px;
1220
}
1223
}
1221
.swagger-section #header form#api_selector .input input#input_baseUrl {
1224
.swagger-section #header form#api_selector .input input#input_baseUrl {
1222
  width: 400px;
1225
  width: 400px;
(-)a/api/v1/doc/index.html (-17 / +24 lines)
Lines 19-27 Link Here
19
  <script src='swagger-ui.js' type='text/javascript'></script>
19
  <script src='swagger-ui.js' type='text/javascript'></script>
20
  <script src='lib/highlight.7.3.pack.js' type='text/javascript'></script>
20
  <script src='lib/highlight.7.3.pack.js' type='text/javascript'></script>
21
  <script src='lib/marked.js' type='text/javascript'></script>
21
  <script src='lib/marked.js' type='text/javascript'></script>
22
  <script src="lib/hmac-sha256.js"></script>
22
23
23
  <!-- enabling this will enable oauth2 implicit scope support -->
24
  <!-- enabling this will enable oauth2 implicit scope support -->
24
  <script src='lib/swagger-oauth.js' type='text/javascript'></script>
25
  <!-- <script src='lib/swagger-oauth.js' type='text/javascript'></script> -->
25
  <script type="text/javascript">
26
  <script type="text/javascript">
26
    $(function () {
27
    $(function () {
27
      var url = window.location.search.match(/url=([^&]+)/);
28
      var url = window.location.search.match(/url=([^&]+)/);
Lines 55-79 Link Here
55
        sorter : "alpha"
56
        sorter : "alpha"
56
      });
57
      });
57
58
58
      function addApiKeyAuthorization() {
59
      function get_url_path_and_query(url) {
59
        var key = $('#input_apiKey')[0].value;
60
        var a = document.createElement('a');
60
        log("key: " + key);
61
        a.href = url;
61
        if(key && key.trim() != "") {
62
        return a.pathname + a.search;
62
            log("added key " + key);
63
            window.authorizations.add("api_key", new ApiKeyAuthorization("api_key", key, "query"));
64
        }
65
      }
63
      }
66
64
67
      $('#input_apiKey').change(function() {
65
      var KohaAuthorization = function() {
68
        addApiKeyAuthorization();
66
      };
69
      });
67
68
      KohaAuthorization.prototype.apply = function(obj, authorizations) {
69
        var user = $('#input_username').val();
70
        var apikey = $('#input_apiKey').val();
71
        if (user && apikey) {
72
          var method = obj.method.toUpperCase();
73
          var url = get_url_path_and_query(obj.url);
74
          var timestamp = +new Date();
75
          var message = method + ' ' + url + ' ' + user + ' ' + timestamp;
76
          obj.headers['X-Koha-Signature'] = CryptoJS.HmacSHA256(message, apikey);
77
          obj.headers['X-Koha-Timestamp'] = timestamp;
78
          obj.headers['X-Koha-Username'] = user;
79
        }
80
      };
70
81
71
      // if you have an apiKey you would like to pre-populate on the page for demonstration purposes...
82
      window.authorizations.add("koha", new KohaAuthorization());
72
      /*
73
        var apiKey = "myApiKeyXXXX123456789";
74
        $('#input_apiKey').val(apiKey);
75
        addApiKeyAuthorization();
76
      */
77
83
78
      window.swaggerUi.load();
84
      window.swaggerUi.load();
79
  });
85
  });
Lines 86-91 Link Here
86
    <a id="logo" href="http://swagger.io">swagger</a>
92
    <a id="logo" href="http://swagger.io">swagger</a>
87
    <form id='api_selector'>
93
    <form id='api_selector'>
88
      <div class='input'><input placeholder="http://example.com/api" id="input_baseUrl" name="baseUrl" type="text"/></div>
94
      <div class='input'><input placeholder="http://example.com/api" id="input_baseUrl" name="baseUrl" type="text"/></div>
95
      <div class='input'><input placeholder="username" id="input_username" name="username" type="text"/></div>
89
      <div class='input'><input placeholder="api_key" id="input_apiKey" name="apiKey" type="text"/></div>
96
      <div class='input'><input placeholder="api_key" id="input_apiKey" name="apiKey" type="text"/></div>
90
      <div class='input'><a id="explore" href="#">Explore</a></div>
97
      <div class='input'><a id="explore" href="#">Explore</a></div>
91
    </form>
98
    </form>
(-)a/api/v1/doc/lib/hmac-sha256.js (+18 lines)
Line 0 Link Here
1
/*
2
CryptoJS v3.1.2
3
code.google.com/p/crypto-js
4
(c) 2009-2013 by Jeff Mott. All rights reserved.
5
code.google.com/p/crypto-js/wiki/License
6
*/
7
var CryptoJS=CryptoJS||function(h,s){var f={},g=f.lib={},q=function(){},m=g.Base={extend:function(a){q.prototype=this;var c=new q;a&&c.mixIn(a);c.hasOwnProperty("init")||(c.init=function(){c.$super.init.apply(this,arguments)});c.init.prototype=c;c.$super=this;return c},create:function(){var a=this.extend();a.init.apply(a,arguments);return a},init:function(){},mixIn:function(a){for(var c in a)a.hasOwnProperty(c)&&(this[c]=a[c]);a.hasOwnProperty("toString")&&(this.toString=a.toString)},clone:function(){return this.init.prototype.extend(this)}},
8
r=g.WordArray=m.extend({init:function(a,c){a=this.words=a||[];this.sigBytes=c!=s?c:4*a.length},toString:function(a){return(a||k).stringify(this)},concat:function(a){var c=this.words,d=a.words,b=this.sigBytes;a=a.sigBytes;this.clamp();if(b%4)for(var e=0;e<a;e++)c[b+e>>>2]|=(d[e>>>2]>>>24-8*(e%4)&255)<<24-8*((b+e)%4);else if(65535<d.length)for(e=0;e<a;e+=4)c[b+e>>>2]=d[e>>>2];else c.push.apply(c,d);this.sigBytes+=a;return this},clamp:function(){var a=this.words,c=this.sigBytes;a[c>>>2]&=4294967295<<
9
32-8*(c%4);a.length=h.ceil(c/4)},clone:function(){var a=m.clone.call(this);a.words=this.words.slice(0);return a},random:function(a){for(var c=[],d=0;d<a;d+=4)c.push(4294967296*h.random()|0);return new r.init(c,a)}}),l=f.enc={},k=l.Hex={stringify:function(a){var c=a.words;a=a.sigBytes;for(var d=[],b=0;b<a;b++){var e=c[b>>>2]>>>24-8*(b%4)&255;d.push((e>>>4).toString(16));d.push((e&15).toString(16))}return d.join("")},parse:function(a){for(var c=a.length,d=[],b=0;b<c;b+=2)d[b>>>3]|=parseInt(a.substr(b,
10
2),16)<<24-4*(b%8);return new r.init(d,c/2)}},n=l.Latin1={stringify:function(a){var c=a.words;a=a.sigBytes;for(var d=[],b=0;b<a;b++)d.push(String.fromCharCode(c[b>>>2]>>>24-8*(b%4)&255));return d.join("")},parse:function(a){for(var c=a.length,d=[],b=0;b<c;b++)d[b>>>2]|=(a.charCodeAt(b)&255)<<24-8*(b%4);return new r.init(d,c)}},j=l.Utf8={stringify:function(a){try{return decodeURIComponent(escape(n.stringify(a)))}catch(c){throw Error("Malformed UTF-8 data");}},parse:function(a){return n.parse(unescape(encodeURIComponent(a)))}},
11
u=g.BufferedBlockAlgorithm=m.extend({reset:function(){this._data=new r.init;this._nDataBytes=0},_append:function(a){"string"==typeof a&&(a=j.parse(a));this._data.concat(a);this._nDataBytes+=a.sigBytes},_process:function(a){var c=this._data,d=c.words,b=c.sigBytes,e=this.blockSize,f=b/(4*e),f=a?h.ceil(f):h.max((f|0)-this._minBufferSize,0);a=f*e;b=h.min(4*a,b);if(a){for(var g=0;g<a;g+=e)this._doProcessBlock(d,g);g=d.splice(0,a);c.sigBytes-=b}return new r.init(g,b)},clone:function(){var a=m.clone.call(this);
12
a._data=this._data.clone();return a},_minBufferSize:0});g.Hasher=u.extend({cfg:m.extend(),init:function(a){this.cfg=this.cfg.extend(a);this.reset()},reset:function(){u.reset.call(this);this._doReset()},update:function(a){this._append(a);this._process();return this},finalize:function(a){a&&this._append(a);return this._doFinalize()},blockSize:16,_createHelper:function(a){return function(c,d){return(new a.init(d)).finalize(c)}},_createHmacHelper:function(a){return function(c,d){return(new t.HMAC.init(a,
13
d)).finalize(c)}}});var t=f.algo={};return f}(Math);
14
(function(h){for(var s=CryptoJS,f=s.lib,g=f.WordArray,q=f.Hasher,f=s.algo,m=[],r=[],l=function(a){return 4294967296*(a-(a|0))|0},k=2,n=0;64>n;){var j;a:{j=k;for(var u=h.sqrt(j),t=2;t<=u;t++)if(!(j%t)){j=!1;break a}j=!0}j&&(8>n&&(m[n]=l(h.pow(k,0.5))),r[n]=l(h.pow(k,1/3)),n++);k++}var a=[],f=f.SHA256=q.extend({_doReset:function(){this._hash=new g.init(m.slice(0))},_doProcessBlock:function(c,d){for(var b=this._hash.words,e=b[0],f=b[1],g=b[2],j=b[3],h=b[4],m=b[5],n=b[6],q=b[7],p=0;64>p;p++){if(16>p)a[p]=
15
c[d+p]|0;else{var k=a[p-15],l=a[p-2];a[p]=((k<<25|k>>>7)^(k<<14|k>>>18)^k>>>3)+a[p-7]+((l<<15|l>>>17)^(l<<13|l>>>19)^l>>>10)+a[p-16]}k=q+((h<<26|h>>>6)^(h<<21|h>>>11)^(h<<7|h>>>25))+(h&m^~h&n)+r[p]+a[p];l=((e<<30|e>>>2)^(e<<19|e>>>13)^(e<<10|e>>>22))+(e&f^e&g^f&g);q=n;n=m;m=h;h=j+k|0;j=g;g=f;f=e;e=k+l|0}b[0]=b[0]+e|0;b[1]=b[1]+f|0;b[2]=b[2]+g|0;b[3]=b[3]+j|0;b[4]=b[4]+h|0;b[5]=b[5]+m|0;b[6]=b[6]+n|0;b[7]=b[7]+q|0},_doFinalize:function(){var a=this._data,d=a.words,b=8*this._nDataBytes,e=8*a.sigBytes;
16
d[e>>>5]|=128<<24-e%32;d[(e+64>>>9<<4)+14]=h.floor(b/4294967296);d[(e+64>>>9<<4)+15]=b;a.sigBytes=4*d.length;this._process();return this._hash},clone:function(){var a=q.clone.call(this);a._hash=this._hash.clone();return a}});s.SHA256=q._createHelper(f);s.HmacSHA256=q._createHmacHelper(f)})(Math);
17
(function(){var h=CryptoJS,s=h.enc.Utf8;h.algo.HMAC=h.lib.Base.extend({init:function(f,g){f=this._hasher=new f.init;"string"==typeof g&&(g=s.parse(g));var h=f.blockSize,m=4*h;g.sigBytes>m&&(g=f.finalize(g));g.clamp();for(var r=this._oKey=g.clone(),l=this._iKey=g.clone(),k=r.words,n=l.words,j=0;j<h;j++)k[j]^=1549556828,n[j]^=909522486;r.sigBytes=l.sigBytes=m;this.reset()},reset:function(){var f=this._hasher;f.reset();f.update(this._iKey)},update:function(f){this._hasher.update(f);return this},finalize:function(f){var g=
18
this._hasher;f=g.finalize(f);g.reset();return g.finalize(this._oKey.clone().concat(f))}})})();
(-)a/installer/data/mysql/kohastructure.sql (+15 lines)
Lines 32-37 CREATE TABLE api_keys ( Link Here
32
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
32
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
33
33
34
--
34
--
35
-- Table structure for table api_timestamps
36
--
37
38
DROP TABLE IF EXISTS api_timestamps;
39
CREATE TABLE api_timestamps (
40
    borrowernumber int(11) NOT NULL, -- foreign key to the borrowers table
41
    timestamp bigint, -- timestamp of the last request from this user
42
    PRIMARY KEY (borrowernumber),
43
    CONSTRAINT api_timestamps_fk_borrowernumber
44
      FOREIGN KEY (borrowernumber)
45
      REFERENCES borrowers (borrowernumber)
46
      ON DELETE CASCADE ON UPDATE CASCADE
47
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
48
49
--
35
-- Table structure for table `auth_header`
50
-- Table structure for table `auth_header`
36
--
51
--
37
52
(-)a/installer/data/mysql/updatedatabase.pl (-1 / +21 lines)
Lines 9889-9894 if(CheckVersion($DBversion)) { Link Here
9889
    SetVersion($DBversion);
9889
    SetVersion($DBversion);
9890
}
9890
}
9891
9891
9892
$DBversion = "XXX";
9893
if(CheckVersion($DBversion)) {
9894
    $dbh->do(q{
9895
        DROP TABLE IF EXISTS api_timestamps;
9896
    });
9897
    $dbh->do(q{
9898
        CREATE TABLE api_timestamps (
9899
            borrowernumber int(11) NOT NULL,
9900
            timestamp bigint,
9901
            PRIMARY KEY (borrowernumber),
9902
            CONSTRAINT api_timestamps_fk_borrowernumber
9903
              FOREIGN KEY (borrowernumber)
9904
              REFERENCES borrowers (borrowernumber)
9905
              ON DELETE CASCADE ON UPDATE CASCADE
9906
        ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
9907
    });
9908
9909
    print "Upgrade to $DBversion done (Bug 13920: Add API timestamps table)\n";
9910
    SetVersion($DBversion);
9911
}
9912
9892
=head1 FUNCTIONS
9913
=head1 FUNCTIONS
9893
9914
9894
=head2 TableExists($table)
9915
=head2 TableExists($table)
9895
- 

Return to bug 13920