View | Details | Raw Unified | Return to bug 13920
Collapse All | Expand All

(-)a/Koha/ApiTimestamp.pm (+46 lines)
Line 0 Link Here
1
package Koha::ApiTimestamp;
2
3
# Copyright BibLibre 2015
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 3 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along
17
# with Koha; if not, write to the Free Software Foundation, Inc.,
18
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19
20
use Modern::Perl;
21
22
use Carp;
23
24
use Koha::Database;
25
26
use base qw(Koha::Object);
27
28
=head1 NAME
29
30
Koha::ApiTimestamp - Koha API Timestamp Object class
31
32
=head1 API
33
34
=head2 Class Methods
35
36
=cut
37
38
=head3 type
39
40
=cut
41
42
sub type {
43
    return 'ApiTimestamp';
44
}
45
46
1;
(-)a/Koha/ApiTimestamps.pm (+58 lines)
Line 0 Link Here
1
package Koha::ApiTimestamps;
2
3
# Copyright BibLibre 2015
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 3 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along
17
# with Koha; if not, write to the Free Software Foundation, Inc.,
18
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19
20
use Modern::Perl;
21
22
use Carp;
23
24
use Koha::Database;
25
26
use Koha::Borrower;
27
28
use base qw(Koha::Objects);
29
30
=head1 NAME
31
32
Koha::ApiTimestamps - Koha API Timestamps Object class
33
34
=head1 API
35
36
=head2 Class Methods
37
38
=cut
39
40
=head3 type
41
42
=cut
43
44
sub type {
45
    return 'ApiTimestamp';
46
}
47
48
sub object_class {
49
    return 'Koha::ApiTimestamp';
50
}
51
52
=head1 AUTHOR
53
54
Kyle M Hall <kyle@bywatersolutions.com>
55
56
=cut
57
58
1;
(-)a/Koha/REST/V1.pm (-3 / +60 lines)
Lines 4-9 use Modern::Perl; Link Here
4
use Mojo::Base 'Mojolicious';
4
use Mojo::Base 'Mojolicious';
5
use Mojo::Log;
5
use Mojo::Log;
6
6
7
use Digest::SHA qw(hmac_sha256_hex);
8
9
use Koha::Borrower;
10
use Koha::Borrowers;
11
use Koha::ApiKey;
12
use Koha::ApiKeys;
13
use Koha::ApiTimestamp;
14
use Koha::ApiTimestamps;
15
16
7
=head startup
17
=head startup
8
18
9
Starts the Mojolicious application using whatever server is configured.
19
Starts the Mojolicious application using whatever server is configured.
Lines 71-79 sub startup { Link Here
71
    my $route = $self->routes->under->to(
81
    my $route = $self->routes->under->to(
72
        cb => sub {
82
        cb => sub {
73
            my $c = shift;
83
            my $c = shift;
74
            my $user = $c->param('user');
84
            my $req_username = $c->req->headers->header('X-Koha-Username');
75
            # Do the authentication stuff here...
85
            my $req_timestamp = $c->req->headers->header('X-Koha-Timestamp');
76
            $c->stash('user', $user);
86
            my $req_signature = $c->req->headers->header('X-Koha-Signature');
87
            my $req_method = $c->req->method;
88
            my $req_url = '/' . $c->req->url->path_query;
89
90
            # "Anonymous" mode
91
            return 1
92
              unless ( defined($req_username)
93
                or defined($req_timestamp)
94
                or defined($req_signature) );
95
96
            my $borrower = Koha::Borrowers->find({userid => $req_username});
97
98
            my @apikeys = Koha::ApiKeys->search({
99
                borrowernumber => $borrower->borrowernumber,
100
                active => 1,
101
            });
102
103
            my $message = "$req_method $req_url $req_username $req_timestamp";
104
            my $signature = '';
105
            foreach my $apikey (@apikeys) {
106
                $signature = hmac_sha256_hex($message, $apikey->api_key);
107
108
                last if $signature eq $req_signature;
109
            }
110
111
            unless ($signature eq $req_signature) {
112
                $c->res->code(403);
113
                $c->render(json => { error => "Authentication failed" });
114
                return;
115
            }
116
117
            my $api_timestamp = Koha::ApiTimestamps->find($borrower->borrowernumber);
118
            my $timestamp = $api_timestamp ? $api_timestamp->timestamp : 0;
119
            unless ($timestamp < $req_timestamp) {
120
                $c->res->code(403);
121
                $c->render(json => { error => "Bad timestamp" });
122
                return;
123
            }
124
125
            unless ($api_timestamp) {
126
                $api_timestamp = new Koha::ApiTimestamp;
127
                $api_timestamp->borrowernumber($borrower->borrowernumber);
128
            }
129
            $api_timestamp->timestamp($req_timestamp);
130
            $api_timestamp->store;
131
132
            # Authentication succeeded, store authenticated user in stash
133
            $c->stash('user', $borrower);
77
            return 1;
134
            return 1;
78
        }
135
        }
79
    );
136
    );
(-)a/Koha/Schema/Result/ApiTimestamp.pm (+81 lines)
Line 0 Link Here
1
use utf8;
2
package Koha::Schema::Result::ApiTimestamp;
3
4
# Created by DBIx::Class::Schema::Loader
5
# DO NOT MODIFY THE FIRST PART OF THIS FILE
6
7
=head1 NAME
8
9
Koha::Schema::Result::ApiTimestamp
10
11
=cut
12
13
use strict;
14
use warnings;
15
16
use base 'DBIx::Class::Core';
17
18
=head1 TABLE: C<api_timestamps>
19
20
=cut
21
22
__PACKAGE__->table("api_timestamps");
23
24
=head1 ACCESSORS
25
26
=head2 borrowernumber
27
28
  data_type: 'integer'
29
  is_foreign_key: 1
30
  is_nullable: 0
31
32
=head2 timestamp
33
34
  data_type: 'bigint'
35
  is_nullable: 1
36
37
=cut
38
39
__PACKAGE__->add_columns(
40
  "borrowernumber",
41
  { data_type => "integer", is_foreign_key => 1, is_nullable => 0 },
42
  "timestamp",
43
  { data_type => "bigint", is_nullable => 1 },
44
);
45
46
=head1 PRIMARY KEY
47
48
=over 4
49
50
=item * L</borrowernumber>
51
52
=back
53
54
=cut
55
56
__PACKAGE__->set_primary_key("borrowernumber");
57
58
=head1 RELATIONS
59
60
=head2 borrowernumber
61
62
Type: belongs_to
63
64
Related object: L<Koha::Schema::Result::Borrower>
65
66
=cut
67
68
__PACKAGE__->belongs_to(
69
  "borrowernumber",
70
  "Koha::Schema::Result::Borrower",
71
  { borrowernumber => "borrowernumber" },
72
  { is_deferrable => 1, on_delete => "CASCADE", on_update => "CASCADE" },
73
);
74
75
76
# Created by DBIx::Class::Schema::Loader v0.07025 @ 2015-03-24 08:27:29
77
# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:FfKz14uY/UgVOWcF4T5J8A
78
79
80
# You can replace this text with custom code or comments, and it will be preserved on regeneration
81
1;
(-)a/installer/data/mysql/kohastructure.sql (+15 lines)
Lines 32-37 CREATE TABLE api_keys ( Link Here
32
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
32
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
33
33
34
--
34
--
35
-- Table structure for table api_timestamps
36
--
37
38
DROP TABLE IF EXISTS api_timestamps;
39
CREATE TABLE api_timestamps (
40
    borrowernumber int(11) NOT NULL, -- foreign key to the borrowers table
41
    timestamp bigint, -- timestamp of the last request from this user
42
    PRIMARY KEY (borrowernumber),
43
    CONSTRAINT api_timestamps_fk_borrowernumber
44
      FOREIGN KEY (borrowernumber)
45
      REFERENCES borrowers (borrowernumber)
46
      ON DELETE CASCADE ON UPDATE CASCADE
47
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
48
49
--
35
-- Table structure for table `auth_header`
50
-- Table structure for table `auth_header`
36
--
51
--
37
52
(-)a/installer/data/mysql/updatedatabase.pl (-1 / +21 lines)
Lines 10663-10668 if(CheckVersion($DBversion)) { Link Here
10663
    SetVersion($DBversion);
10663
    SetVersion($DBversion);
10664
}
10664
}
10665
10665
10666
$DBversion = "XXX";
10667
if(CheckVersion($DBversion)) {
10668
    $dbh->do(q{
10669
        DROP TABLE IF EXISTS api_timestamps;
10670
    });
10671
    $dbh->do(q{
10672
        CREATE TABLE api_timestamps (
10673
            borrowernumber int(11) NOT NULL,
10674
            timestamp bigint,
10675
            PRIMARY KEY (borrowernumber),
10676
            CONSTRAINT api_timestamps_fk_borrowernumber
10677
              FOREIGN KEY (borrowernumber)
10678
              REFERENCES borrowers (borrowernumber)
10679
              ON DELETE CASCADE ON UPDATE CASCADE
10680
        ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
10681
    });
10682
10683
    print "Upgrade to $DBversion done (Bug 13920: Add API timestamps table)\n";
10684
    SetVersion($DBversion);
10685
}
10686
10666
10687
10667
# DEVELOPER PROCESS, search for anything to execute in the db_update directory
10688
# DEVELOPER PROCESS, search for anything to execute in the db_update directory
10668
# SEE bug 13068
10689
# SEE bug 13068
10669
- 

Return to bug 13920