View | Details | Raw Unified | Return to bug 14868
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-17 / +37 lines)
Lines 18-45 package Koha::REST::V1; Link Here
18
use Modern::Perl;
18
use Modern::Perl;
19
use Mojo::Base 'Mojolicious';
19
use Mojo::Base 'Mojolicious';
20
20
21
use C4::Auth qw( check_cookie_auth get_session );
21
22
use C4::Auth qw( check_cookie_auth get_session haspermission );
22
use C4::Context;
23
use C4::Context;
23
use Koha::Patrons;
24
use Koha::Patrons;
24
25
25
sub startup {
26
sub startup {
26
    my $self = shift;
27
    my $self = shift;
27
28
28
    my $route = $self->routes->under->to(
29
        cb => sub {
30
            my $c = shift;
31
32
            my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'));
33
            if ($status eq "ok") {
34
                my $session = get_session($sessionID);
35
                my $user = Koha::Patrons->find($session->param('number'));
36
                $c->stash('koha.user' => $user);
37
            }
38
39
            return 1;
40
        }
41
    );
42
43
    # Force charset=utf8 in Content-Type header for JSON responses
29
    # Force charset=utf8 in Content-Type header for JSON responses
44
    $self->types->type(json => 'application/json; charset=utf8');
30
    $self->types->type(json => 'application/json; charset=utf8');
45
31
Lines 51-57 sub startup { Link Here
51
    }
37
    }
52
38
53
    $self->plugin(Swagger2 => {
39
    $self->plugin(Swagger2 => {
54
        route => $route,
55
        url => $self->home->rel_file("api/v1/swagger/swagger.min.json"),
40
        url => $self->home->rel_file("api/v1/swagger/swagger.min.json"),
56
    });
41
    });
57
}
42
}
Lines 80-83 sub _isMinificationRequired { Link Here
80
    return 1 if -C $pathToSwaggerJson < -C $pathToSwaggerMinJson; # compare modification time
65
    return 1 if -C $pathToSwaggerJson < -C $pathToSwaggerMinJson; # compare modification time
81
}
66
}
82
67
68
sub authenticate_api_request {
69
    my ($next, $c, $action_spec) = @_;
70
71
    my ($session, $user);
72
    my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'));
73
    if ($status eq "ok") {
74
        $session = get_session($sessionID);
75
        $user = Koha::Patrons->find($session->param('number'));
76
        $c->stash('koha.user' => $user);
77
    }
78
    else {
79
        return $c->render_swagger(
80
            { error => "Invalid authorization key" },
81
            {},
82
            401
83
        );
84
    }
85
86
    if ($action_spec->{'x-koha-permission'}) {
87
        if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) {
88
            return $next->($c);
89
        }
90
        else {
91
            return $c->render_swagger(
92
                { error => "No permission" },
93
                {},
94
                403
95
            );
96
        }
97
    }
98
    else {
99
        return $next->($c);
100
    }
101
}
102
83
1;
103
1;
(-)a/api/v1/swagger/swagger.json (+1 lines)
Lines 13-18 Link Here
13
    }
13
    }
14
  },
14
  },
15
  "basePath": "/api/v1",
15
  "basePath": "/api/v1",
16
  "x-mojo-around-action": "Koha::REST::V1::authenticate_api_request",
16
  "paths": {
17
  "paths": {
17
    "$ref": "paths.json"
18
    "$ref": "paths.json"
18
  },
19
  },
(-)a/t/db_dependent/api/v1/patrons.t (-3 / +2 lines)
Lines 47-56 my $borrower = $builder->build({ Link Here
47
});
47
});
48
48
49
$t->get_ok('/api/v1/patrons')
49
$t->get_ok('/api/v1/patrons')
50
  ->status_is(403);
50
  ->status_is(401);
51
51
52
$t->get_ok("/api/v1/patrons/" . $borrower->{ borrowernumber })
52
$t->get_ok("/api/v1/patrons/" . $borrower->{ borrowernumber })
53
  ->status_is(403);
53
  ->status_is(401);
54
54
55
my $loggedinuser = $builder->build({
55
my $loggedinuser = $builder->build({
56
    source => 'Borrower',
56
    source => 'Borrower',
57
- 

Return to bug 14868