View | Details | Raw Unified | Return to bug 14868
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-17 / +52 lines)
Lines 18-45 package Koha::REST::V1; Link Here
18
use Modern::Perl;
18
use Modern::Perl;
19
use Mojo::Base 'Mojolicious';
19
use Mojo::Base 'Mojolicious';
20
20
21
use C4::Auth qw( check_cookie_auth get_session );
21
use C4::Auth qw( check_cookie_auth get_session haspermission );
22
use C4::Context;
22
use C4::Context;
23
use Koha::Patrons;
23
use Koha::Patrons;
24
24
25
sub startup {
25
sub startup {
26
    my $self = shift;
26
    my $self = shift;
27
27
28
    my $route = $self->routes->under->to(
29
        cb => sub {
30
            my $c = shift;
31
32
            my ($status, $sessionID) = check_cookie_auth($c->cookie('CGISESSID'));
33
            if ($status eq "ok") {
34
                my $session = get_session($sessionID);
35
                my $user = Koha::Patrons->find($session->param('number'));
36
                $c->stash('koha.user' => $user);
37
            }
38
39
            return 1;
40
        }
41
    );
42
43
    # Force charset=utf8 in Content-Type header for JSON responses
28
    # Force charset=utf8 in Content-Type header for JSON responses
44
    $self->types->type(json => 'application/json; charset=utf8');
29
    $self->types->type(json => 'application/json; charset=utf8');
45
30
Lines 49-57 sub startup { Link Here
49
    }
34
    }
50
35
51
    $self->plugin(Swagger2 => {
36
    $self->plugin(Swagger2 => {
52
        route => $route,
53
        url => $self->home->rel_file("api/v1/swagger/swagger.min.json"),
37
        url => $self->home->rel_file("api/v1/swagger/swagger.min.json"),
54
    });
38
    });
55
}
39
}
56
40
41
=head3 authenticate_api_request
42
43
Validates authentication and allows access if authorization is not required or
44
if authorization is required and user has required permissions to access.
45
46
This subroutine is called before every request to API.
47
48
=cut
49
50
sub authenticate_api_request {
51
    my ($next, $c, $action_spec) = @_;
52
53
    my ($session, $user);
54
    my $cookie = $c->cookie('CGISESSID');
55
    my ($status, $sessionID) = check_cookie_auth($cookie);
56
    if ($status eq "ok") {
57
        $session = get_session($sessionID);
58
        $user = Koha::Patrons->find($session->param('number'));
59
        $c->stash('koha.user' => $user);
60
    }
61
    else {
62
        return $c->render_swagger(
63
            { error => "Authentication failure." },
64
            {},
65
            401
66
        ) if $cookie;
67
    }
68
69
    if ($action_spec->{'x-koha-permission'}) {
70
        return $c->render_swagger(
71
            { error => "Authentication required." },
72
            {},
73
            401
74
        ) unless $user;
75
76
        if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) {
77
            return $next->($c);
78
        }
79
        else {
80
            return $c->render_swagger(
81
                { error => "Authorization failure. Missing required permission(s)." },
82
                {},
83
                403
84
            );
85
        }
86
    }
87
    else {
88
        return $next->($c);
89
    }
90
}
91
57
1;
92
1;
(-)a/api/v1/swagger/swagger.json (-1 / +1 lines)
Lines 13-18 Link Here
13
    }
13
    }
14
  },
14
  },
15
  "basePath": "/api/v1",
15
  "basePath": "/api/v1",
16
  "x-mojo-around-action": "Koha::REST::V1::authenticate_api_request",
16
  "paths": {
17
  "paths": {
17
    "$ref": "paths.json"
18
    "$ref": "paths.json"
18
  },
19
  },
19
- 

Return to bug 14868