View | Details | Raw Unified | Return to bug 14868
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-17 / +36 lines)
Lines 20-26 use Mojo::Base 'Mojolicious'; Link Here
20
20
21
use File::Find::Rule;
21
use File::Find::Rule;
22
22
23
use C4::Auth qw( check_cookie_auth get_session );
23
use C4::Auth qw( check_cookie_auth get_session haspermission );
24
use C4::Context;
24
use C4::Context;
25
use Koha::Logger;
25
use Koha::Logger;
26
use Koha::Patrons;
26
use Koha::Patrons;
Lines 28-48 use Koha::Patrons; Link Here
28
sub startup {
28
sub startup {
29
    my $self = shift;
29
    my $self = shift;
30
30
31
    my $route = $self->routes->under->to(
32
        cb => sub {
33
            my $c = shift;
34
35
            my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'));
36
            if ($status eq "ok") {
37
                my $session = get_session($sessionID);
38
                my $user = Koha::Patrons->find($session->param('number'));
39
                $c->stash('koha.user' => $user);
40
            }
41
42
            return 1;
43
        }
44
    );
45
46
    # Force charset=utf8 in Content-Type header for JSON responses
31
    # Force charset=utf8 in Content-Type header for JSON responses
47
    $self->types->type(json => 'application/json; charset=utf8');
32
    $self->types->type(json => 'application/json; charset=utf8');
48
33
Lines 54-60 sub startup { Link Here
54
    }
39
    }
55
40
56
    $self->plugin(Swagger2 => {
41
    $self->plugin(Swagger2 => {
57
        route => $route,
58
        url => $self->home->rel_file("api/v1/swagger/swagger.min.json"),
42
        url => $self->home->rel_file("api/v1/swagger/swagger.min.json"),
59
    });
43
    });
60
}
44
}
Lines 103-106 sub _isMinificationRequired { Link Here
103
    return 1 if $latestModification < -C $pathToSwaggerMinJson; # compare modification time
87
    return 1 if $latestModification < -C $pathToSwaggerMinJson; # compare modification time
104
}
88
}
105
89
90
sub authenticate_api_request {
91
    my ($next, $c, $action_spec) = @_;
92
93
    my ($session, $user);
94
    my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'));
95
    if ($status eq "ok") {
96
        $session = get_session($sessionID);
97
        $user = Koha::Patrons->find($session->param('number'));
98
        $c->stash('koha.user' => $user);
99
    }
100
    else {
101
        return $c->render_swagger(
102
            { error => "Invalid authorization key" },
103
            {},
104
            401
105
        );
106
    }
107
108
    if ($action_spec->{'x-koha-permission'}) {
109
        if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) {
110
            return $next->($c);
111
        }
112
        else {
113
            return $c->render_swagger(
114
                { error => "No permission" },
115
                {},
116
                403
117
            );
118
        }
119
    }
120
    else {
121
        return $next->($c);
122
    }
123
}
124
106
1;
125
1;
(-)a/api/v1/swagger/swagger.json (+1 lines)
Lines 13-18 Link Here
13
    }
13
    }
14
  },
14
  },
15
  "basePath": "/api/v1",
15
  "basePath": "/api/v1",
16
  "x-mojo-around-action": "Koha::REST::V1::authenticate_api_request",
16
  "paths": {
17
  "paths": {
17
    "$ref": "paths.json"
18
    "$ref": "paths.json"
18
  },
19
  },
(-)a/t/db_dependent/api/v1/patrons.t (-3 / +2 lines)
Lines 47-56 my $borrower = $builder->build({ Link Here
47
});
47
});
48
48
49
$t->get_ok('/api/v1/patrons')
49
$t->get_ok('/api/v1/patrons')
50
  ->status_is(403);
50
  ->status_is(401);
51
51
52
$t->get_ok("/api/v1/patrons/" . $borrower->{ borrowernumber })
52
$t->get_ok("/api/v1/patrons/" . $borrower->{ borrowernumber })
53
  ->status_is(403);
53
  ->status_is(401);
54
54
55
my $loggedinuser = $builder->build({
55
my $loggedinuser = $builder->build({
56
    source => 'Borrower',
56
    source => 'Borrower',
57
- 

Return to bug 14868