View | Details | Raw Unified | Return to bug 14868
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-17 / +36 lines)
Lines 20-47 use Mojo::Base 'Mojolicious'; Link Here
20
20
21
use File::Find::Rule;
21
use File::Find::Rule;
22
22
23
use C4::Auth qw( check_cookie_auth get_session );
23
use C4::Auth qw( check_cookie_auth get_session haspermission );
24
use C4::Context;
24
use C4::Context;
25
use Koha::Patrons;
25
use Koha::Patrons;
26
26
27
sub startup {
27
sub startup {
28
    my $self = shift;
28
    my $self = shift;
29
29
30
    my $route = $self->routes->under->to(
31
        cb => sub {
32
            my $c = shift;
33
34
            my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'));
35
            if ($status eq "ok") {
36
                my $session = get_session($sessionID);
37
                my $user = Koha::Patrons->find($session->param('number'));
38
                $c->stash('koha.user' => $user);
39
            }
40
41
            return 1;
42
        }
43
    );
44
45
    # Force charset=utf8 in Content-Type header for JSON responses
30
    # Force charset=utf8 in Content-Type header for JSON responses
46
    $self->types->type(json => 'application/json; charset=utf8');
31
    $self->types->type(json => 'application/json; charset=utf8');
47
32
Lines 53-59 sub startup { Link Here
53
    }
38
    }
54
39
55
    $self->plugin(Swagger2 => {
40
    $self->plugin(Swagger2 => {
56
        route => $route,
57
        url => $self->home->rel_file("api/v1/swagger/swagger.min.json"),
41
        url => $self->home->rel_file("api/v1/swagger/swagger.min.json"),
58
    });
42
    });
59
}
43
}
Lines 91-94 sub _isMinificationRequired { Link Here
91
    return 1 if $latestModification < -C $pathToSwaggerMinJson; # compare modification time
75
    return 1 if $latestModification < -C $pathToSwaggerMinJson; # compare modification time
92
}
76
}
93
77
78
sub authenticate_api_request {
79
    my ($next, $c, $action_spec) = @_;
80
81
    my ($session, $user);
82
    my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'));
83
    if ($status eq "ok") {
84
        $session = get_session($sessionID);
85
        $user = Koha::Patrons->find($session->param('number'));
86
        $c->stash('koha.user' => $user);
87
    }
88
    else {
89
        return $c->render_swagger(
90
            { error => "Invalid authorization key" },
91
            {},
92
            401
93
        );
94
    }
95
96
    if ($action_spec->{'x-koha-permission'}) {
97
        if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) {
98
            return $next->($c);
99
        }
100
        else {
101
            return $c->render_swagger(
102
                { error => "No permission" },
103
                {},
104
                403
105
            );
106
        }
107
    }
108
    else {
109
        return $next->($c);
110
    }
111
}
112
94
1;
113
1;
(-)a/api/v1/swagger/swagger.json (+1 lines)
Lines 13-18 Link Here
13
    }
13
    }
14
  },
14
  },
15
  "basePath": "/api/v1",
15
  "basePath": "/api/v1",
16
  "x-mojo-around-action": "Koha::REST::V1::authenticate_api_request",
16
  "paths": {
17
  "paths": {
17
    "$ref": "paths.json"
18
    "$ref": "paths.json"
18
  },
19
  },
(-)a/t/db_dependent/api/v1/patrons.t (-3 / +2 lines)
Lines 47-56 my $borrower = $builder->build({ Link Here
47
});
47
});
48
48
49
$t->get_ok('/api/v1/patrons')
49
$t->get_ok('/api/v1/patrons')
50
  ->status_is(403);
50
  ->status_is(401);
51
51
52
$t->get_ok("/api/v1/patrons/" . $borrower->{ borrowernumber })
52
$t->get_ok("/api/v1/patrons/" . $borrower->{ borrowernumber })
53
  ->status_is(403);
53
  ->status_is(401);
54
54
55
my $loggedinuser = $builder->build({
55
my $loggedinuser = $builder->build({
56
    source => 'Borrower',
56
    source => 'Borrower',
57
- 

Return to bug 14868