From afe895bbb71a00b9bb861de32ace8140f800bbd1 Mon Sep 17 00:00:00 2001 From: Julian Maurice Date: Thu, 26 Mar 2015 19:14:01 +0100 Subject: [PATCH] [DO NOT PUSH] Bug 13920: Example usage for api authentication --- Koha/Borrower.pm | 14 ++++++++++++++ Koha/REST/V1/Borrowers.pm | 28 +++++++++++++++++++++++++++- api/v1/swagger.json | 24 ++++++++++++++++++++++++ 3 files changed, 65 insertions(+), 1 deletion(-) diff --git a/Koha/Borrower.pm b/Koha/Borrower.pm index 93426bf..1e3cd35 100644 --- a/Koha/Borrower.pm +++ b/Koha/Borrower.pm @@ -23,6 +23,8 @@ use Carp; use Koha::Database; +use C4::Auth; + use base qw(Koha::Object); =head1 NAME @@ -43,6 +45,18 @@ sub type { return 'Borrower'; } +=head2 Instance Methods + +=head3 haspermission + +=cut + +sub haspermission { + my ($self, $flags) = @_; + + return C4::Auth::haspermission($self->userid, $flags); +} + =head1 AUTHOR Kyle M Hall diff --git a/Koha/REST/V1/Borrowers.pm b/Koha/REST/V1/Borrowers.pm index b58ad2a..d1d673a 100644 --- a/Koha/REST/V1/Borrowers.pm +++ b/Koha/REST/V1/Borrowers.pm @@ -5,10 +5,23 @@ use Modern::Perl; use Mojo::Base 'Mojolicious::Controller'; use Koha::Borrowers; +use C4::Auth; sub list_borrowers { my ($c, $args, $cb) = @_; + my $user = $c->stash('user'); + + unless ($user) { + return $c->$cb({error => "Authentication required"}, 401); + } + + unless ($user->haspermission({ borrowers => 1 })) { + return $c->$cb({ + error => "You don't have permission to see users" + }, 403 ); + } + my $borrowers = Koha::Borrowers->search; $c->$cb($borrowers->unblessed, 200); @@ -17,7 +30,20 @@ sub list_borrowers { sub get_borrower { my ($c, $args, $cb) = @_; - my $borrower = Koha::Borrowers->find($args->{borrowernumber}); + my $user = $c->stash('user'); + my $borrowernumber = $args->{borrowernumber}; + + unless ($user) { + return $c->$cb({error => "Authentication required"}, 401); + } + + unless ($user->haspermission({ borrowers => 1 })) { + return $c->$cb({ + error => "You don't have permission to see users" + }, 403 ); + } + + my $borrower = Koha::Borrowers->find($borrowernumber); if ($borrower) { return $c->$cb($borrower->unblessed, 200); diff --git a/api/v1/swagger.json b/api/v1/swagger.json index 5e97d03..b80ddda 100644 --- a/api/v1/swagger.json +++ b/api/v1/swagger.json @@ -31,6 +31,18 @@ "$ref": "#/definitions/borrower" } } + }, + "401": { + "description": "Authentication required", + "schema": { + "$ref": "#/definitions/error" + } + }, + "403": { + "description": "Missing permission", + "schema": { + "$ref": "#/definitions/error" + } } } } @@ -55,6 +67,18 @@ "$ref": "#/definitions/borrower" } }, + "401": { + "description": "Authentication required", + "schema": { + "$ref": "#/definitions/error" + } + }, + "403": { + "description": "Missing permission", + "schema": { + "$ref": "#/definitions/error" + } + }, "404": { "description": "Borrower not found", "schema": { -- 1.9.1