View | Details | Raw Unified | Return to bug 20402
Collapse All | Expand All

(-)a/Koha/OAuth.pm (+2 lines)
Lines 21-26 sub _verify_client_cb { Link Here
21
    my ($client_id, $scopes_ref, $client_secret)
21
    my ($client_id, $scopes_ref, $client_secret)
22
        = @args{ qw/ client_id scopes client_secret / };
22
        = @args{ qw/ client_id scopes client_secret / };
23
23
24
    return (0, 'unauthorized_client') unless $client_id;
25
24
    my $clients = C4::Context->config('api_client');
26
    my $clients = C4::Context->config('api_client');
25
    $clients = [ $clients ] unless ref $clients eq 'ARRAY';
27
    $clients = [ $clients ] unless ref $clients eq 'ARRAY';
26
    my ($client) = grep { $_->{client_id} eq $client_id } @$clients;
28
    my ($client) = grep { $_->{client_id} eq $client_id } @$clients;
(-)a/Koha/REST/V1/OAuth.pm (-2 / +8 lines)
Lines 10-19 use C4::Context; Link Here
10
sub token {
10
sub token {
11
    my $c = shift->openapi->valid_input or return;
11
    my $c = shift->openapi->valid_input or return;
12
12
13
    my $grant = Koha::OAuth->grant;
13
    my $grant_type = $c->validation->param('grant_type');
14
    unless ($grant_type eq 'client_credentials') {
15
        return $c->render(status => 400, openapi => {error => 'Unimplemented grant type'});
16
    }
17
14
    my $client_id = $c->validation->param('client_id');
18
    my $client_id = $c->validation->param('client_id');
15
    my $client_secret = $c->validation->param('client_secret');
19
    my $client_secret = $c->validation->param('client_secret');
16
    my $scope = [ split / /, $c->validation->param('scope') ];
20
    my $scope = [ split / /, ($c->validation->param('scope') // '') ];
21
22
    my $grant = Koha::OAuth->grant;
17
23
18
    # verify a client against known clients
24
    # verify a client against known clients
19
    my ( $is_valid, $error, $scopes ) = $grant->verify_client(
25
    my ( $is_valid, $error, $scopes ) = $grant->verify_client(
(-)a/api/v1/swagger/paths/oauth.json (+12 lines)
Lines 42-51 Link Here
42
                        "properties": {
42
                        "properties": {
43
                            "access_token": {
43
                            "access_token": {
44
                                "type": "string"
44
                                "type": "string"
45
                            },
46
                            "token_type": {
47
                                "type": "string"
48
                            },
49
                            "expires_in": {
50
                                "type": "integer"
45
                            }
51
                            }
46
                        }
52
                        }
47
                    }
53
                    }
48
                },
54
                },
55
                "400": {
56
                    "description": "Bad Request",
57
                    "schema": {
58
                        "$ref": "../definitions.json#/error"
59
                    }
60
                },
49
                "403": {
61
                "403": {
50
                    "description": "Access forbidden",
62
                    "description": "Access forbidden",
51
                    "schema": {
63
                    "schema": {
(-)a/t/db_dependent/api/v1/oauth.t (-1 / +79 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/env perl
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it under the
6
# terms of the GNU General Public License as published by the Free Software
7
# Foundation; either version 3 of the License, or (at your option) any later
8
# version.
9
#
10
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
11
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
12
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
13
#
14
# You should have received a copy of the GNU General Public License along
15
# with Koha; if not, write to the Free Software Foundation, Inc.,
16
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
17
18
use Modern::Perl;
19
20
use Test::More tests => 1;
21
use Test::Mojo;
22
23
use Koha::Database;
24
25
use t::lib::Mocks;
26
27
my $t = Test::Mojo->new('Koha::REST::V1');
28
my $schema  = Koha::Database->new->schema;
29
30
subtest '/oauth/token tests' => sub {
31
    plan tests => 17;
32
33
    $schema->storage->txn_begin;
34
35
    # Missing parameter grant_type
36
    $t->post_ok('/api/v1/oauth/token')
37
        ->status_is(400);
38
39
    # Wrong grant type
40
    $t->post_ok('/api/v1/oauth/token', form => { grant_type => 'password' })
41
        ->status_is(400)
42
        ->json_is({error => 'Unimplemented grant type'});
43
44
    # No client_id/client_secret
45
    $t->post_ok('/api/v1/oauth/token', form => { grant_type => 'client_credentials' })
46
        ->status_is(403)
47
        ->json_is({error => 'unauthorized_client'});
48
49
    my ($client_id, $client_secret) = ('client1', 'secr3t');
50
    t::lib::Mocks::mock_config('api_client', {
51
        'client_id' => $client_id,
52
        'client_secret' => $client_secret,
53
        'scope' => ['patrons.read'],
54
    });
55
56
    my $formData = {
57
        grant_type => 'client_credentials',
58
        client_id => $client_id,
59
        client_secret => $client_secret,
60
        scope => 'patrons.read',
61
    };
62
    $t->post_ok('/api/v1/oauth/token', form => $formData)
63
        ->status_is(200)
64
        ->json_is('/expires_in' => 3600)
65
        ->json_is('/token_type' => 'Bearer')
66
        ->json_has('/access_token');
67
68
    my $access_token = $t->tx->res->json->{access_token};
69
70
    # Without access token, it returns 401
71
    $t->get_ok('/api/v1/patrons')->status_is(401);
72
73
    # With access token, it returns 200
74
    my $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
75
    $tx->req->headers->authorization("Bearer $access_token");
76
    $t->request_ok($tx)->status_is(200);
77
78
    $schema->storage->txn_rollback;
79
};

Return to bug 20402