View | Details | Raw Unified | Return to bug 14868
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-17 / +36 lines)
Lines 20-26 use Mojo::Base 'Mojolicious'; Link Here
20
20
21
use File::Find::Rule;
21
use File::Find::Rule;
22
22
23
use C4::Auth qw( check_cookie_auth get_session );
23
use C4::Auth qw( check_cookie_auth get_session haspermission );
24
use C4::Context;
24
use C4::Context;
25
use Koha::Logger;
25
use Koha::Logger;
26
use Koha::Patrons;
26
use Koha::Patrons;
Lines 28-48 use Koha::Patrons; Link Here
28
sub startup {
28
sub startup {
29
    my $self = shift;
29
    my $self = shift;
30
30
31
    my $route = $self->routes->under->to(
32
        cb => sub {
33
            my $c = shift;
34
35
            my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'));
36
            if ($status eq "ok") {
37
                my $session = get_session($sessionID);
38
                my $user = Koha::Patrons->find($session->param('number'));
39
                $c->stash('koha.user' => $user);
40
            }
41
42
            return 1;
43
        }
44
    );
45
46
    # Force charset=utf8 in Content-Type header for JSON responses
31
    # Force charset=utf8 in Content-Type header for JSON responses
47
    $self->types->type(json => 'application/json; charset=utf8');
32
    $self->types->type(json => 'application/json; charset=utf8');
48
33
Lines 54-60 sub startup { Link Here
54
    }
39
    }
55
40
56
    $self->plugin(Swagger2 => {
41
    $self->plugin(Swagger2 => {
57
        route => $route,
58
        url => $self->home->rel_file("api/v1/swagger/swagger.min.json"),
42
        url => $self->home->rel_file("api/v1/swagger/swagger.min.json"),
59
    });
43
    });
60
}
44
}
Lines 102-105 sub _isMinificationRequired { Link Here
102
    return 1 if $latestModification < -C $pathToSwaggerMinJson; # compare modification time
86
    return 1 if $latestModification < -C $pathToSwaggerMinJson; # compare modification time
103
}
87
}
104
88
89
sub authenticate_api_request {
90
    my ($next, $c, $action_spec) = @_;
91
92
    my ($session, $user);
93
    my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'));
94
    if ($status eq "ok") {
95
        $session = get_session($sessionID);
96
        $user = Koha::Patrons->find($session->param('number'));
97
        $c->stash('koha.user' => $user);
98
    }
99
    else {
100
        return $c->render_swagger(
101
            { error => "Invalid authorization key" },
102
            {},
103
            401
104
        );
105
    }
106
107
    if ($action_spec->{'x-koha-permission'}) {
108
        if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) {
109
            return $next->($c);
110
        }
111
        else {
112
            return $c->render_swagger(
113
                { error => "No permission" },
114
                {},
115
                403
116
            );
117
        }
118
    }
119
    else {
120
        return $next->($c);
121
    }
122
}
123
105
1;
124
1;
(-)a/api/v1/swagger/swagger.json (+1 lines)
Lines 13-18 Link Here
13
    }
13
    }
14
  },
14
  },
15
  "basePath": "/api/v1",
15
  "basePath": "/api/v1",
16
  "x-mojo-around-action": "Koha::REST::V1::authenticate_api_request",
16
  "paths": {
17
  "paths": {
17
    "$ref": "paths.json"
18
    "$ref": "paths.json"
18
  },
19
  },
(-)a/t/db_dependent/api/v1/patrons.t (-3 / +2 lines)
Lines 47-56 my $borrower = $builder->build({ Link Here
47
});
47
});
48
48
49
$t->get_ok('/api/v1/patrons')
49
$t->get_ok('/api/v1/patrons')
50
  ->status_is(403);
50
  ->status_is(401);
51
51
52
$t->get_ok("/api/v1/patrons/" . $borrower->{ borrowernumber })
52
$t->get_ok("/api/v1/patrons/" . $borrower->{ borrowernumber })
53
  ->status_is(403);
53
  ->status_is(401);
54
54
55
my $loggedinuser = $builder->build({
55
my $loggedinuser = $builder->build({
56
    source => 'Borrower',
56
    source => 'Borrower',
57
- 

Return to bug 14868