View | Details | Raw Unified | Return to bug 20402
Collapse All | Expand All

(-)a/Koha/REST/V1/Auth.pm (-20 / +28 lines)
Lines 113-139 sub authenticate_api_request { Link Here
113
    my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'};
113
    my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'};
114
    my $authorization = $spec->{'x-koha-authorization'};
114
    my $authorization = $spec->{'x-koha-authorization'};
115
115
116
    if (my $oauth = $c->oauth) {
116
    my $authorization_header = $c->req->headers->authorization;
117
        my $clients = C4::Context->config('api_client');
117
    if ($authorization_header and $authorization_header =~ /^Bearer /) {
118
        $clients = [ $clients ] unless ref $clients eq 'ARRAY';
118
        if (my $oauth = $c->oauth) {
119
        my ($client) = grep { $_->{client_id} eq $oauth->{client_id} } @$clients;
119
            my $clients = C4::Context->config('api_client');
120
120
            $clients = [ $clients ] unless ref $clients eq 'ARRAY';
121
        my $patron = Koha::Patrons->find($client->{patron_id});
121
            my ($client) = grep { $_->{client_id} eq $oauth->{client_id} } @$clients;
122
        my $permissions = $authorization->{'permissions'};
122
123
        # Check if the patron is authorized
123
            my $patron = Koha::Patrons->find($client->{patron_id});
124
        if ( haspermission($patron->userid, $permissions)
124
            my $permissions = $authorization->{'permissions'};
125
            or allow_owner($c, $authorization, $patron)
125
            # Check if the patron is authorized
126
            or allow_guarantor($c, $authorization, $patron) ) {
126
            if ( haspermission($patron->userid, $permissions)
127
127
                or allow_owner($c, $authorization, $patron)
128
            validate_query_parameters( $c, $spec );
128
                or allow_guarantor($c, $authorization, $patron) ) {
129
129
130
            # Everything is ok
130
                validate_query_parameters( $c, $spec );
131
            return 1;
131
132
                # Everything is ok
133
                return 1;
134
            }
135
136
            Koha::Exceptions::Authorization::Unauthorized->throw(
137
                error => "Authorization failure. Missing required permission(s).",
138
                required_permissions => $permissions,
139
            );
132
        }
140
        }
133
141
134
        Koha::Exceptions::Authorization::Unauthorized->throw(
142
        # If we have "Authorization: Bearer" header and oauth authentication
135
            error => "Authorization failure. Missing required permission(s).",
143
        # failed, do not try other authentication means
136
            required_permissions => $permissions,
144
        Koha::Exceptions::Authentication::Required->throw(
145
            error => 'Authentication failure.'
137
        );
146
        );
138
    }
147
    }
139
148
140
- 

Return to bug 20402