From 644ac0c16403ad2090acf49eb13aa14a8a041090 Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Mon, 22 Aug 2016 15:00:29 +0300 Subject: [PATCH] Bug 17004: Add API route for logging out user To test: 1. Login to Koha either by newly introduced POST /auth/session or traditional way. 2. Send a DELETE request to /auth/session 3. Observe that you are no longer logged-in in Koha. 4. Repeat step 2 and observe error about invalid session id. You may find this cURL useful: curl -X DELETE http://lib/api/v1/auth/session --cookie 'CGISESSID=88e735aaf7c6cf194a775425cbd00570' (replace CGISESSID=... with your CGISESSID) --- Koha/REST/V1/Auth.pm | 17 ++++++++++++++++ api/v1/definitions/sessionid.json | 10 ++++++++++ api/v1/swagger.json | 35 +++++++++++++++++++++++++++++++++ t/db_dependent/api/v1/auth.t | 41 ++++++++++++++++++++++++++++++++++++++- 4 files changed, 102 insertions(+), 1 deletion(-) create mode 100644 api/v1/definitions/sessionid.json diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm index 8f3e07a..7c75191 100644 --- a/Koha/REST/V1/Auth.pm +++ b/Koha/REST/V1/Auth.pm @@ -56,6 +56,23 @@ sub login { return $c->$cb($session, 201); } +sub logout { + my ($c, $args, $cb) = @_; + + my $sessionid = $args->{session}->{sessionid}; + $sessionid = $c->cookie('CGISESSID') unless $sessionid; + + my ($status, $sid) = C4::Auth::check_cookie_auth($sessionid); + unless ($status eq "ok") { + return $c->$cb({ error => "Invalid session id."}, 401); + } + + my $session = C4::Auth::get_session($sessionid); + $session->delete; + $session->flush; + return $c->$cb({}, 200); +} + sub _swaggerize_session { my ($sessionid, $patron) = @_; diff --git a/api/v1/definitions/sessionid.json b/api/v1/definitions/sessionid.json new file mode 100644 index 0000000..6e013aa --- /dev/null +++ b/api/v1/definitions/sessionid.json @@ -0,0 +1,10 @@ +{ + "type": "object", + "properties": { + "sessionid": { + "description": "The Koha sessionid", + "type": "string" + } + }, + "required": ["sessionid"] +} diff --git a/api/v1/swagger.json b/api/v1/swagger.json index 256aee6..8b2d7b7 100644 --- a/api/v1/swagger.json +++ b/api/v1/swagger.json @@ -42,6 +42,32 @@ } } } + }, + "delete": { + "operationId": "logoutAuth", + "tags": ["auth"], + "summary": "Logout from Koha.", + "description": "Logouts user from Koha by marking session as expired. sessionid is optional, if not given, logs out currently logged in user", + "parameters": [ + { "$ref": "#/parameters/sessionidBodyParam" } + ], + "produces": [ + "application/json" + ], + "responses": { + "200": { + "description": "Successfully logged out", + "schema": { + "type": "object" + } + }, + "401": { + "description": "Bad session id", + "schema": { + "$ref": "#/definitions/error" + } + } + } } }, "/patrons": { @@ -395,6 +421,15 @@ "required": true, "type": "string" }, + "sessionidBodyParam": { + "name": "session", + "description": "The CGISESSID Cookie used to authenticate a session", + "in": "body", + "required": false, + "schema" : { + "$ref": "definitions/sessionid.json" + } + }, "useridPostParam": { "name": "userid", "in": "formData", diff --git a/t/db_dependent/api/v1/auth.t b/t/db_dependent/api/v1/auth.t index 33055c2..56d1a87 100644 --- a/t/db_dependent/api/v1/auth.t +++ b/t/db_dependent/api/v1/auth.t @@ -19,11 +19,12 @@ use Modern::Perl; -use Test::More tests => 20; +use Test::More tests => 38; use Test::Mojo; use t::lib::TestBuilder; +use C4::Auth; use C4::Context; use Koha::AuthUtils; @@ -85,6 +86,7 @@ $t->request_ok($tx) ->json_is('/borrowernumber', $borrower->{borrowernumber}) ->json_is('/email', $borrower->{email}) ->json_has('/sessionid'); +my $sessionid = $tx->res->json->{sessionid}; $tx = $t->ua->build_tx(POST => '/api/v1/auth/session' => form => $invalid_login); $tx->req->env({REMOTE_ADDR => '127.0.0.1'}); @@ -98,4 +100,41 @@ $t->request_ok($tx) ->status_is(401) ->json_is('/error', "Login failed."); +$tx = $t->ua->build_tx(DELETE => '/api/v1/auth/session' => json => { sessionid => $sessionid."123" }); +$tx->req->env({REMOTE_ADDR => '127.0.0.1'}); +$t->request_ok($tx) + ->status_is(401) + ->json_is('/error', "Invalid session id."); + +my ($sess_status, $sid) = C4::Auth::check_cookie_auth($sessionid); +is($sess_status, "ok", "Session is valid before logging out."); +$tx = $t->ua->build_tx(DELETE => '/api/v1/auth/session' => json => { sessionid => $sessionid }); +$tx->req->env({REMOTE_ADDR => '127.0.0.1'}); +$t->request_ok($tx) + ->status_is(200); + +($sess_status, $sid) = C4::Auth::check_cookie_auth($sessionid); +isnt($sess_status, "ok", "Session is not valid after logging out."); + +$tx = $t->ua->build_tx(POST => '/api/v1/auth/session' => form => $auth_by_cardnumber); +$tx->req->env({REMOTE_ADDR => '127.0.0.1'}); +$t->request_ok($tx) + ->status_is(201) + ->json_is('/firstname', $borrower->{firstname}) + ->json_is('/surname', $borrower->{surname}) + ->json_is('/borrowernumber', $borrower->{borrowernumber}) + ->json_is('/email', $borrower->{email}) + ->json_has('/sessionid'); +$sessionid = $tx->res->json->{sessionid}; + +($sess_status, $sid) = C4::Auth::check_cookie_auth($sessionid); +is($sess_status, "ok", "Session is valid before logging out."); +$tx = $t->ua->build_tx(DELETE => '/api/v1/auth/session'); +$tx->req->env({REMOTE_ADDR => '127.0.0.1'}); +$t->request_ok($tx) + ->status_is(200); + +($sess_status, $sid) = C4::Auth::check_cookie_auth($sessionid); +isnt($sess_status, "ok", "Session is not valid after logging out."); + $dbh->rollback; -- 1.9.1