View | Details | Raw Unified | Return to bug 20612
Collapse All | Expand All

(-)a/Koha/OAuth.pm (-8 / +10 lines)
Lines 17-22 package Koha::OAuth; Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Koha::ApiKeys;
20
use Koha::OAuthAccessTokens;
21
use Koha::OAuthAccessTokens;
21
22
22
=head1 NAME
23
=head1 NAME
Lines 53-69 and allowed to get authorization. Link Here
53
sub _verify_client_cb {
54
sub _verify_client_cb {
54
    my (%args) = @_;
55
    my (%args) = @_;
55
56
56
    my ($client_id, $client_secret)
57
    my ($client_id, $client_secret) = @args{ qw/ client_id client_secret / };
57
        = @args{ qw/ client_id client_secret / };
58
58
59
    return (0, 'unauthorized_client') unless $client_id;
59
    my $api_key;
60
60
61
    my $clients = C4::Context->config('api_client');
61
    if ($client_id) {
62
    $clients = [ $clients ] unless ref $clients eq 'ARRAY';
62
        $api_key = Koha::ApiKeys->single({ client_id => $client_id });
63
    my ($client) = grep { $_->{client_id} eq $client_id } @$clients;
63
    }
64
    return (0, 'unauthorized_client') unless $client;
64
65
    # client_id mandatory and exists on the DB
66
    return (0, 'unauthorized_client') unless $api_key && $api_key->active;
65
67
66
    return (0, 'access_denied') unless $client_secret eq $client->{client_secret};
68
    return (0, 'access_denied') unless $api_key->secret eq $client_secret;
67
69
68
    return (1, undef, []);
70
    return (1, undef, []);
69
}
71
}
(-)a/Koha/REST/V1/Auth.pm (-6 / +4 lines)
Lines 26-35 use Net::OAuth2::AuthorizationServer; Link Here
26
use C4::Auth qw( check_cookie_auth get_session haspermission );
26
use C4::Auth qw( check_cookie_auth get_session haspermission );
27
use C4::Context;
27
use C4::Context;
28
28
29
use Koha::ApiKeys;
29
use Koha::Account::Lines;
30
use Koha::Account::Lines;
30
use Koha::Checkouts;
31
use Koha::Checkouts;
31
use Koha::Holds;
32
use Koha::Holds;
32
use Koha::OAuth;
33
use Koha::OAuth;
34
use Koha::OAuthAccessTokens;
33
use Koha::Old::Checkouts;
35
use Koha::Old::Checkouts;
34
use Koha::Patrons;
36
use Koha::Patrons;
35
37
Lines 125-135 sub authenticate_api_request { Link Here
125
        );
127
        );
126
128
127
        if ($valid_token) {
129
        if ($valid_token) {
128
            my $clients = C4::Context->config('api_client');
130
            my $patron_id = Koha::ApiKeys->single({ client_id => $valid_token->{client_id} })->patron_id;
129
            $clients = [ $clients ] unless ref $clients eq 'ARRAY';
131
            my $patron = Koha::Patrons->find($patron_id);
130
            my ($client) = grep { $_->{client_id} eq $valid_token->{client_id} } @$clients;
131
132
            my $patron = Koha::Patrons->find($client->{patron_id});
133
            my $permissions = $authorization->{'permissions'};
132
            my $permissions = $authorization->{'permissions'};
134
            # Check if the patron is authorized
133
            # Check if the patron is authorized
135
            if ( haspermission($patron->userid, $permissions)
134
            if ( haspermission($patron->userid, $permissions)
136
- 

Return to bug 20612