@@ -, +, @@ on/off - Apply the patches - Run: $ kshell k$ prove t/db_dependent/api/v1/auth.t - Sign off :-D --- Koha/REST/V1/Auth.pm | 14 ++++++++++++++ t/db_dependent/api/v1/auth.t | 17 ++++++++++++++++- 2 files changed, 30 insertions(+), 1 deletion(-) --- a/Koha/REST/V1/Auth.pm +++ a/Koha/REST/V1/Auth.pm @@ -57,8 +57,19 @@ sub under { my $c = shift->openapi->valid_input or return;; my $status = 0; + try { + # /api/v1/{namespace} + my $namespace = $c->req->url->to_abs->path->[2]; + + if ( $namespace eq 'public' + and !C4::Context->preference('RESTPublicAPI') ) + { + Koha::Exceptions::Authorization->throw( + "Configuration prevents the usage of this endpoint by unprivileged users"); + } + $status = authenticate_api_request($c); } catch { @@ -89,6 +100,9 @@ sub under { required_permissions => $_->required_permissions, }); } + elsif ($_->isa('Koha::Exceptions::Authorization')) { + return $c->render(status => 403, json => { error => $_->error }); + } elsif ($_->isa('Koha::Exceptions')) { return $c->render(status => 500, json => { error => $_->error }); } --- a/t/db_dependent/api/v1/auth.t +++ a/t/db_dependent/api/v1/auth.t @@ -39,12 +39,27 @@ my $t = Test::Mojo->new('Koha::REST::V1'); my $tx; subtest 'under() tests' => sub { - plan tests => 15; + + plan tests => 20; $schema->storage->txn_begin; my ($borrowernumber, $session_id) = create_user_and_session(); + # disable the /public namespace + t::lib::Mocks::mock_preference( 'RESTPublicAPI', 0 ); + $tx = $t->ua->build_tx( POST => "/api/v1/public/patrons/$borrowernumber/password" ); + $tx->req->env( { REMOTE_ADDR => $remote_address } ); + $t->request_ok($tx) + ->status_is(403) + ->json_is('/error', 'Configuration prevents the usage of this endpoint by unprivileged users'); + + # enable the /public namespace + t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 ); + $tx = $t->ua->build_tx( GET => "/api/v1/public/patrons/$borrowernumber/password" ); + $tx->req->env( { REMOTE_ADDR => $remote_address } ); + $t->request_ok($tx)->status_is(404); + # 401 (no authentication) $tx = $t->ua->build_tx( GET => "/api/v1/patrons" ); $tx->req->env( { REMOTE_ADDR => $remote_address } ); --