Lines 113-118
if authorization is required and user has required permissions to access.
Link Here
|
113 |
sub authenticate_api_request { |
113 |
sub authenticate_api_request { |
114 |
my ( $c ) = @_; |
114 |
my ( $c ) = @_; |
115 |
|
115 |
|
|
|
116 |
my $user; |
117 |
|
116 |
my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; |
118 |
my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; |
117 |
my $authorization = $spec->{'x-koha-authorization'}; |
119 |
my $authorization = $spec->{'x-koha-authorization'}; |
118 |
|
120 |
|
Lines 138-206
sub authenticate_api_request {
Link Here
|
138 |
); |
140 |
); |
139 |
|
141 |
|
140 |
if ($valid_token) { |
142 |
if ($valid_token) { |
141 |
my $patron_id = Koha::ApiKeys->find( $valid_token->{client_id} )->patron_id; |
143 |
my $patron_id = Koha::ApiKeys->find( $valid_token->{client_id} )->patron_id; |
142 |
my $patron = Koha::Patrons->find($patron_id); |
144 |
$user = Koha::Patrons->find($patron_id); |
143 |
$c->stash('koha.user' => $patron); |
145 |
} |
144 |
|
146 |
else { |
145 |
my $permissions = $authorization->{'permissions'}; |
147 |
# If we have "Authorization: Bearer" header and oauth authentication |
146 |
# Check if the patron is authorized |
148 |
# failed, do not try other authentication means |
147 |
if ( haspermission($patron->userid, $permissions) |
149 |
Koha::Exceptions::Authentication::Required->throw( |
148 |
or allow_owner($c, $authorization, $patron) |
150 |
error => 'Authentication failure.' |
149 |
or allow_guarantor($c, $authorization, $patron) ) { |
|
|
150 |
|
151 |
validate_query_parameters( $c, $spec ); |
152 |
|
153 |
# Everything is ok |
154 |
return 1; |
155 |
} |
156 |
|
157 |
Koha::Exceptions::Authorization::Unauthorized->throw( |
158 |
error => "Authorization failure. Missing required permission(s).", |
159 |
required_permissions => $permissions, |
160 |
); |
151 |
); |
161 |
} |
152 |
} |
162 |
|
|
|
163 |
# If we have "Authorization: Bearer" header and oauth authentication |
164 |
# failed, do not try other authentication means |
165 |
Koha::Exceptions::Authentication::Required->throw( |
166 |
error => 'Authentication failure.' |
167 |
); |
168 |
} |
169 |
|
170 |
my $cookie = $c->cookie('CGISESSID'); |
171 |
my ($session, $user); |
172 |
# Mojo doesn't use %ENV the way CGI apps do |
173 |
# Manually pass the remote_address to check_auth_cookie |
174 |
my $remote_addr = $c->tx->remote_address; |
175 |
my ($status, $sessionID) = check_cookie_auth( |
176 |
$cookie, undef, |
177 |
{ remote_addr => $remote_addr }); |
178 |
if ($status eq "ok") { |
179 |
$session = get_session($sessionID); |
180 |
$user = Koha::Patrons->find($session->param('number')); |
181 |
$c->stash('koha.user' => $user); |
182 |
} |
183 |
elsif ($status eq "maintenance") { |
184 |
Koha::Exceptions::UnderMaintenance->throw( |
185 |
error => 'System is under maintenance.' |
186 |
); |
187 |
} |
153 |
} |
188 |
elsif ($status eq "expired" and $authorization) { |
154 |
else { |
189 |
Koha::Exceptions::Authentication::SessionExpired->throw( |
155 |
|
190 |
error => 'Session has been expired.' |
156 |
my $cookie = $c->cookie('CGISESSID'); |
191 |
); |
157 |
|
192 |
} |
158 |
# Mojo doesn't use %ENV the way CGI apps do |
193 |
elsif ($status eq "failed" and $authorization) { |
159 |
# Manually pass the remote_address to check_auth_cookie |
194 |
Koha::Exceptions::Authentication::Required->throw( |
160 |
my $remote_addr = $c->tx->remote_address; |
195 |
error => 'Authentication failure.' |
161 |
my ($status, $sessionID) = check_cookie_auth( |
196 |
); |
162 |
$cookie, undef, |
197 |
} |
163 |
{ remote_addr => $remote_addr }); |
198 |
elsif ($authorization) { |
164 |
if ($status eq "ok") { |
199 |
Koha::Exceptions::Authentication->throw( |
165 |
my $session = get_session($sessionID); |
200 |
error => 'Unexpected authentication status.' |
166 |
$user = Koha::Patrons->find($session->param('number')); |
201 |
); |
167 |
# $c->stash('koha.user' => $user); |
|
|
168 |
} |
169 |
elsif ($status eq "maintenance") { |
170 |
Koha::Exceptions::UnderMaintenance->throw( |
171 |
error => 'System is under maintenance.' |
172 |
); |
173 |
} |
174 |
elsif ($status eq "expired" and $authorization) { |
175 |
Koha::Exceptions::Authentication::SessionExpired->throw( |
176 |
error => 'Session has been expired.' |
177 |
); |
178 |
} |
179 |
elsif ($status eq "failed" and $authorization) { |
180 |
Koha::Exceptions::Authentication::Required->throw( |
181 |
error => 'Authentication failure.' |
182 |
); |
183 |
} |
184 |
elsif ($authorization) { |
185 |
Koha::Exceptions::Authentication->throw( |
186 |
error => 'Unexpected authentication status.' |
187 |
); |
188 |
} |
202 |
} |
189 |
} |
203 |
|
190 |
|
|
|
191 |
$c->stash('koha.user' => $user); |
192 |
|
204 |
# We do not need any authorization |
193 |
# We do not need any authorization |
205 |
unless ($authorization) { |
194 |
unless ($authorization) { |
206 |
# Check the parameters |
195 |
# Check the parameters |
Lines 225-230
sub authenticate_api_request {
Link Here
|
225 |
required_permissions => $permissions, |
214 |
required_permissions => $permissions, |
226 |
); |
215 |
); |
227 |
} |
216 |
} |
|
|
217 |
|
228 |
sub validate_query_parameters { |
218 |
sub validate_query_parameters { |
229 |
my ( $c, $action_spec ) = @_; |
219 |
my ( $c, $action_spec ) = @_; |
230 |
|
220 |
|
231 |
- |
|
|