Bugzilla – Attachment 54683 Details for
Bug 17004
REST API: add route to authenticate patron (Single Sign On - SSO)
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 17004: Add API route for logging out user
Bug-17004-Add-API-route-for-logging-out-user.patch (text/plain), 5.38 KB, created by
Lari Taskula
on 2016-08-22 12:10:46 UTC
(
hide
)
Description:
Bug 17004: Add API route for logging out user
Filename:
MIME Type:
Creator:
Lari Taskula
Created:
2016-08-22 12:10:46 UTC
Size:
5.38 KB
patch
obsolete
>From 219c61237288dda685fea91892b6f29f40ca197c Mon Sep 17 00:00:00 2001 >From: Lari Taskula <larit@student.uef.fi> >Date: Mon, 22 Aug 2016 15:00:29 +0300 >Subject: [PATCH] Bug 17004: Add API route for logging out user > >To test: >1. Login to Koha either by newly introduced POST /auth/session > or traditional way. >2. Send a DELETE request to /auth/session >3. Observe that you are no longer logged-in in Koha. >4. Repeat step 2 and observe error about invalid session id. > >You may find this cURL useful: >curl -X DELETE http://lib/api/v1/auth/session --cookie 'CGISESSID=88e735aaf7c6cf194a775425cbd00570' >(replace CGISESSID=... with your CGISESSID) >--- > Koha/REST/V1/Auth.pm | 17 +++++++++++++++++ > api/v1/swagger.json | 35 +++++++++++++++++++++++++++++++++++ > t/db_dependent/api/v1/auth.t | 41 ++++++++++++++++++++++++++++++++++++++++- > 3 files changed, 92 insertions(+), 1 deletion(-) > >diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm >index 8f3e07a..7c75191 100644 >--- a/Koha/REST/V1/Auth.pm >+++ b/Koha/REST/V1/Auth.pm >@@ -56,6 +56,23 @@ sub login { > return $c->$cb($session, 201); > } > >+sub logout { >+ my ($c, $args, $cb) = @_; >+ >+ my $sessionid = $args->{session}->{sessionid}; >+ $sessionid = $c->cookie('CGISESSID') unless $sessionid; >+ >+ my ($status, $sid) = C4::Auth::check_cookie_auth($sessionid); >+ unless ($status eq "ok") { >+ return $c->$cb({ error => "Invalid session id."}, 401); >+ } >+ >+ my $session = C4::Auth::get_session($sessionid); >+ $session->delete; >+ $session->flush; >+ return $c->$cb({}, 200); >+} >+ > sub _swaggerize_session { > my ($sessionid, $patron) = @_; > >diff --git a/api/v1/swagger.json b/api/v1/swagger.json >index 256aee6..62a2872 100644 >--- a/api/v1/swagger.json >+++ b/api/v1/swagger.json >@@ -42,6 +42,32 @@ > } > } > } >+ }, >+ "delete": { >+ "operationId": "logoutAuth", >+ "tags": ["auth"], >+ "summary": "Logout from Koha.", >+ "description": "Logouts user from Koha by marking session as expired. sessionid is optional, if not given, logs out currently logged in user", >+ "parameters": [ >+ { "$ref": "#/parameters/sessionBodyParam" } >+ ], >+ "produces": [ >+ "application/json" >+ ], >+ "responses": { >+ "200": { >+ "description": "Successfully logged out", >+ "schema": { >+ "type": "object" >+ } >+ }, >+ "401": { >+ "description": "Bad session id", >+ "schema": { >+ "$ref": "#/definitions/error" >+ } >+ } >+ } > } > }, > "/patrons": { >@@ -395,6 +421,15 @@ > "required": true, > "type": "string" > }, >+ "sessionBodyParam": { >+ "name": "session", >+ "description": "The CGISESSID Cookie used to authenticate a session", >+ "in": "body", >+ "required": false, >+ "schema" : { >+ "$ref": "definitions/session.json" >+ } >+ }, > "useridPostParam": { > "name": "userid", > "in": "formData", >diff --git a/t/db_dependent/api/v1/auth.t b/t/db_dependent/api/v1/auth.t >index 33055c2..56d1a87 100644 >--- a/t/db_dependent/api/v1/auth.t >+++ b/t/db_dependent/api/v1/auth.t >@@ -19,11 +19,12 @@ > > use Modern::Perl; > >-use Test::More tests => 20; >+use Test::More tests => 38; > use Test::Mojo; > > use t::lib::TestBuilder; > >+use C4::Auth; > use C4::Context; > use Koha::AuthUtils; > >@@ -85,6 +86,7 @@ $t->request_ok($tx) > ->json_is('/borrowernumber', $borrower->{borrowernumber}) > ->json_is('/email', $borrower->{email}) > ->json_has('/sessionid'); >+my $sessionid = $tx->res->json->{sessionid}; > > $tx = $t->ua->build_tx(POST => '/api/v1/auth/session' => form => $invalid_login); > $tx->req->env({REMOTE_ADDR => '127.0.0.1'}); >@@ -98,4 +100,41 @@ $t->request_ok($tx) > ->status_is(401) > ->json_is('/error', "Login failed."); > >+$tx = $t->ua->build_tx(DELETE => '/api/v1/auth/session' => json => { sessionid => $sessionid."123" }); >+$tx->req->env({REMOTE_ADDR => '127.0.0.1'}); >+$t->request_ok($tx) >+ ->status_is(401) >+ ->json_is('/error', "Invalid session id."); >+ >+my ($sess_status, $sid) = C4::Auth::check_cookie_auth($sessionid); >+is($sess_status, "ok", "Session is valid before logging out."); >+$tx = $t->ua->build_tx(DELETE => '/api/v1/auth/session' => json => { sessionid => $sessionid }); >+$tx->req->env({REMOTE_ADDR => '127.0.0.1'}); >+$t->request_ok($tx) >+ ->status_is(200); >+ >+($sess_status, $sid) = C4::Auth::check_cookie_auth($sessionid); >+isnt($sess_status, "ok", "Session is not valid after logging out."); >+ >+$tx = $t->ua->build_tx(POST => '/api/v1/auth/session' => form => $auth_by_cardnumber); >+$tx->req->env({REMOTE_ADDR => '127.0.0.1'}); >+$t->request_ok($tx) >+ ->status_is(201) >+ ->json_is('/firstname', $borrower->{firstname}) >+ ->json_is('/surname', $borrower->{surname}) >+ ->json_is('/borrowernumber', $borrower->{borrowernumber}) >+ ->json_is('/email', $borrower->{email}) >+ ->json_has('/sessionid'); >+$sessionid = $tx->res->json->{sessionid}; >+ >+($sess_status, $sid) = C4::Auth::check_cookie_auth($sessionid); >+is($sess_status, "ok", "Session is valid before logging out."); >+$tx = $t->ua->build_tx(DELETE => '/api/v1/auth/session'); >+$tx->req->env({REMOTE_ADDR => '127.0.0.1'}); >+$t->request_ok($tx) >+ ->status_is(200); >+ >+($sess_status, $sid) = C4::Auth::check_cookie_auth($sessionid); >+isnt($sess_status, "ok", "Session is not valid after logging out."); >+ > $dbh->rollback; >-- >1.9.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 17004
:
54028
|
54068
|
54682
|
54683
|
54684
|
54711
|
54953
|
54957
|
55146