View | Details | Raw Unified | Return to bug 14868
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-17 / +45 lines)
Lines 3-36 package Koha::REST::V1; Link Here
3
use Modern::Perl;
3
use Modern::Perl;
4
use Mojo::Base 'Mojolicious';
4
use Mojo::Base 'Mojolicious';
5
5
6
use C4::Auth qw( check_cookie_auth get_session );
6
use C4::Auth qw( check_cookie_auth get_session haspermission );
7
use Koha::Borrowers;
7
use Koha::Borrowers;
8
8
9
sub startup {
9
sub startup {
10
    my $self = shift;
10
    my $self = shift;
11
11
12
    my $route = $self->routes->under->to(
13
        cb => sub {
14
            my $c = shift;
15
16
            my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'));
17
            if ($status eq "ok") {
18
                my $session = get_session($sessionID);
19
                my $user = Koha::Borrowers->find($session->param('number'));
20
                $c->stash('koha.user' => $user);
21
            }
22
23
            return 1;
24
        }
25
    );
26
27
    # Force charset=utf8 in Content-Type header for JSON responses
12
    # Force charset=utf8 in Content-Type header for JSON responses
28
    $self->types->type(json => 'application/json; charset=utf8');
13
    $self->types->type(json => 'application/json; charset=utf8');
29
14
30
    $self->plugin(Swagger2 => {
15
    $self->plugin(Swagger2 => {
31
        route => $route,
32
        url => $self->home->rel_file("api/v1/swagger.json"),
16
        url => $self->home->rel_file("api/v1/swagger.json"),
33
    });
17
    });
34
}
18
}
35
19
20
sub authenticate_api_request {
21
    my ($next, $c, $action_spec) = @_;
22
23
    # Go to the action if the Authorization header is valid
24
    my ($session, $user);
25
    my $cookie = $c->tx->req->cookie('CGISESSID');
26
    my ($status, $sessionID) = check_cookie_auth($cookie->value) if $cookie;
27
    if ($status eq "ok") {
28
        $session = get_session($sessionID);
29
        $user = Koha::Borrowers->find($session->param('number'));
30
        $c->stash('koha.user' => $user);
31
    }
32
    else {
33
        return $c->render_swagger(
34
            {errors => [{message => "Invalid authorization key", path => "/"}]},
35
            {},
36
            401
37
        );
38
    }
39
40
    if ($action_spec->{'x-koha-permission'}) {
41
        if (C4::Auth::haspermission($user, $action_spec->{'x-koha-permission'})) {
42
            return $next->($c);
43
        }
44
        else {
45
            return $c->render_swagger(
46
                {errors => [{message => "No permission", path => "/"}]},
47
                {},
48
                401
49
            );
50
        }
51
    }
52
    else {
53
        return $next->($c);
54
    }
55
56
    #If everything else fails, DO NOT authenticate by default!
57
    return $c->render_swagger(
58
        {errors => [{message => "Something bad happened when authenticating request", path => "/"}]},
59
        {},
60
        500
61
    );
62
}
63
36
1;
64
1;
(-)a/api/v1/swagger.json (-1 / +7 lines)
Lines 13-22 Link Here
13
    }
13
    }
14
  },
14
  },
15
  "basePath": "/api/v1",
15
  "basePath": "/api/v1",
16
  "x-mojo-around-action": "Koha::REST::V1::authenticate_api_request",
16
  "paths": {
17
  "paths": {
17
    "/borrowers": {
18
    "/borrowers": {
18
      "get": {
19
      "get": {
19
        "x-mojo-controller": "Koha::REST::V1::Borrowers",
20
        "x-mojo-controller": "Koha::REST::V1::Borrowers",
21
        "x-koha-permission": {
22
          "borrowers": "1"
23
        },
20
        "operationId": "listBorrowers",
24
        "operationId": "listBorrowers",
21
        "tags": ["borrowers"],
25
        "tags": ["borrowers"],
22
        "produces": [
26
        "produces": [
Lines 44-49 Link Here
44
    "/borrowers/{borrowernumber}": {
48
    "/borrowers/{borrowernumber}": {
45
      "get": {
49
      "get": {
46
        "x-mojo-controller": "Koha::REST::V1::Borrowers",
50
        "x-mojo-controller": "Koha::REST::V1::Borrowers",
51
        "x-koha-permission": {
52
          "borrowers": "1"
53
        },
47
        "operationId": "getBorrower",
54
        "operationId": "getBorrower",
48
        "tags": ["borrowers"],
55
        "tags": ["borrowers"],
49
        "parameters": [
56
        "parameters": [
50
- 

Return to bug 14868