View | Details | Raw Unified | Return to bug 14868
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-22 / +57 lines)
Lines 18-50 package Koha::REST::V1; Link Here
18
use Modern::Perl;
18
use Modern::Perl;
19
use Mojo::Base 'Mojolicious';
19
use Mojo::Base 'Mojolicious';
20
20
21
use C4::Auth qw( check_cookie_auth get_session );
21
use C4::Auth qw( check_cookie_auth get_session haspermission );
22
use C4::Context;
22
use C4::Context;
23
use Koha::Patrons;
23
use Koha::Patrons;
24
24
25
sub startup {
25
sub startup {
26
    my $self = shift;
26
    my $self = shift;
27
27
28
    my $route = $self->routes->under->to(
29
        cb => sub {
30
            my $c = shift;
31
            # Mojo doesn't use %ENV the way CGI apps do
32
            # Manually pass the remote_address to check_auth_cookie
33
            my $remote_addr = $c->tx->remote_address;
34
            my ($status, $sessionID) = check_cookie_auth(
35
                                            $c->cookie('CGISESSID'), undef,
36
                                            { remote_addr => $remote_addr });
37
38
            if ($status eq "ok") {
39
                my $session = get_session($sessionID);
40
                my $user = Koha::Patrons->find($session->param('number'));
41
                $c->stash('koha.user' => $user);
42
            }
43
44
            return 1;
45
        }
46
    );
47
48
    # Force charset=utf8 in Content-Type header for JSON responses
28
    # Force charset=utf8 in Content-Type header for JSON responses
49
    $self->types->type(json => 'application/json; charset=utf8');
29
    $self->types->type(json => 'application/json; charset=utf8');
50
30
Lines 54-62 sub startup { Link Here
54
    }
34
    }
55
35
56
    $self->plugin(Swagger2 => {
36
    $self->plugin(Swagger2 => {
57
        route => $route,
58
        url => $self->home->rel_file("api/v1/swagger/swagger.min.json"),
37
        url => $self->home->rel_file("api/v1/swagger/swagger.min.json"),
59
    });
38
    });
60
}
39
}
61
40
41
=head3 authenticate_api_request
42
43
Validates authentication and allows access if authorization is not required or
44
if authorization is required and user has required permissions to access.
45
46
This subroutine is called before every request to API.
47
48
=cut
49
50
sub authenticate_api_request {
51
    my ($next, $c, $action_spec) = @_;
52
53
    my ($session, $user);
54
    my $cookie = $c->cookie('CGISESSID');
55
    # Mojo doesn't use %ENV the way CGI apps do
56
    # Manually pass the remote_address to check_auth_cookie
57
    my $remote_addr = $c->tx->remote_address;
58
    my ($status, $sessionID) = check_cookie_auth(
59
                                            $cookie, undef,
60
                                            { remote_addr => $remote_addr });
61
    if ($status eq "ok") {
62
        $session = get_session($sessionID);
63
        $user = Koha::Patrons->find($session->param('number'));
64
        $c->stash('koha.user' => $user);
65
    }
66
    else {
67
        return $c->render_swagger(
68
            { error => "Authentication failure." },
69
            {},
70
            401
71
        ) if $cookie and $action_spec->{'x-koha-permission'};
72
    }
73
74
    if ($action_spec->{'x-koha-permission'}) {
75
        return $c->render_swagger(
76
            { error => "Authentication required." },
77
            {},
78
            401
79
        ) unless $user;
80
81
        if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) {
82
            return $next->($c);
83
        }
84
        else {
85
            return $c->render_swagger(
86
                { error => "Authorization failure. Missing required permission(s)." },
87
                {},
88
                403
89
            );
90
        }
91
    }
92
    else {
93
        return $next->($c);
94
    }
95
}
96
62
1;
97
1;
(-)a/api/v1/swagger/swagger.json (-1 / +1 lines)
Lines 13-18 Link Here
13
    }
13
    }
14
  },
14
  },
15
  "basePath": "/api/v1",
15
  "basePath": "/api/v1",
16
  "x-mojo-around-action": "Koha::REST::V1::authenticate_api_request",
16
  "paths": {
17
  "paths": {
17
    "$ref": "paths.json"
18
    "$ref": "paths.json"
18
  },
19
  },
19
- 

Return to bug 14868