View | Details | Raw Unified | Return to bug 22071
Collapse All | Expand All

(-)a/Koha/REST/V1/Auth.pm (-59 / +48 lines)
Lines 113-118 if authorization is required and user has required permissions to access. Link Here
113
sub authenticate_api_request {
113
sub authenticate_api_request {
114
    my ( $c ) = @_;
114
    my ( $c ) = @_;
115
115
116
    my $user;
117
116
    my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'};
118
    my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'};
117
    my $authorization = $spec->{'x-koha-authorization'};
119
    my $authorization = $spec->{'x-koha-authorization'};
118
120
Lines 138-206 sub authenticate_api_request { Link Here
138
        );
140
        );
139
141
140
        if ($valid_token) {
142
        if ($valid_token) {
141
            my $patron_id   = Koha::ApiKeys->find( $valid_token->{client_id} )->patron_id;
143
            my $patron_id = Koha::ApiKeys->find( $valid_token->{client_id} )->patron_id;
142
            my $patron      = Koha::Patrons->find($patron_id);
144
            $user         = Koha::Patrons->find($patron_id);
143
            $c->stash('koha.user' => $patron);
145
        }
144
146
        else {
145
            my $permissions = $authorization->{'permissions'};
147
            # If we have "Authorization: Bearer" header and oauth authentication
146
            # Check if the patron is authorized
148
            # failed, do not try other authentication means
147
            if ( haspermission($patron->userid, $permissions)
149
            Koha::Exceptions::Authentication::Required->throw(
148
                or allow_owner($c, $authorization, $patron)
150
                error => 'Authentication failure.'
149
                or allow_guarantor($c, $authorization, $patron) ) {
150
151
                validate_query_parameters( $c, $spec );
152
153
                # Everything is ok
154
                return 1;
155
            }
156
157
            Koha::Exceptions::Authorization::Unauthorized->throw(
158
                error => "Authorization failure. Missing required permission(s).",
159
                required_permissions => $permissions,
160
            );
151
            );
161
        }
152
        }
162
163
        # If we have "Authorization: Bearer" header and oauth authentication
164
        # failed, do not try other authentication means
165
        Koha::Exceptions::Authentication::Required->throw(
166
            error => 'Authentication failure.'
167
        );
168
    }
169
170
    my $cookie = $c->cookie('CGISESSID');
171
    my ($session, $user);
172
    # Mojo doesn't use %ENV the way CGI apps do
173
    # Manually pass the remote_address to check_auth_cookie
174
    my $remote_addr = $c->tx->remote_address;
175
    my ($status, $sessionID) = check_cookie_auth(
176
                                            $cookie, undef,
177
                                            { remote_addr => $remote_addr });
178
    if ($status eq "ok") {
179
        $session = get_session($sessionID);
180
        $user = Koha::Patrons->find($session->param('number'));
181
        $c->stash('koha.user' => $user);
182
    }
183
    elsif ($status eq "maintenance") {
184
        Koha::Exceptions::UnderMaintenance->throw(
185
            error => 'System is under maintenance.'
186
        );
187
    }
153
    }
188
    elsif ($status eq "expired" and $authorization) {
154
    else {
189
        Koha::Exceptions::Authentication::SessionExpired->throw(
155
190
            error => 'Session has been expired.'
156
        my $cookie = $c->cookie('CGISESSID');
191
        );
157
192
    }
158
        # Mojo doesn't use %ENV the way CGI apps do
193
    elsif ($status eq "failed" and $authorization) {
159
        # Manually pass the remote_address to check_auth_cookie
194
        Koha::Exceptions::Authentication::Required->throw(
160
        my $remote_addr = $c->tx->remote_address;
195
            error => 'Authentication failure.'
161
        my ($status, $sessionID) = check_cookie_auth(
196
        );
162
                                                $cookie, undef,
197
    }
163
                                                { remote_addr => $remote_addr });
198
    elsif ($authorization) {
164
        if ($status eq "ok") {
199
        Koha::Exceptions::Authentication->throw(
165
            my $session = get_session($sessionID);
200
            error => 'Unexpected authentication status.'
166
            $user = Koha::Patrons->find($session->param('number'));
201
        );
167
            # $c->stash('koha.user' => $user);
168
        }
169
        elsif ($status eq "maintenance") {
170
            Koha::Exceptions::UnderMaintenance->throw(
171
                error => 'System is under maintenance.'
172
            );
173
        }
174
        elsif ($status eq "expired" and $authorization) {
175
            Koha::Exceptions::Authentication::SessionExpired->throw(
176
                error => 'Session has been expired.'
177
            );
178
        }
179
        elsif ($status eq "failed" and $authorization) {
180
            Koha::Exceptions::Authentication::Required->throw(
181
                error => 'Authentication failure.'
182
            );
183
        }
184
        elsif ($authorization) {
185
            Koha::Exceptions::Authentication->throw(
186
                error => 'Unexpected authentication status.'
187
            );
188
        }
202
    }
189
    }
203
190
191
    $c->stash('koha.user' => $user);
192
204
    # We do not need any authorization
193
    # We do not need any authorization
205
    unless ($authorization) {
194
    unless ($authorization) {
206
        # Check the parameters
195
        # Check the parameters
Lines 225-230 sub authenticate_api_request { Link Here
225
        required_permissions => $permissions,
214
        required_permissions => $permissions,
226
    );
215
    );
227
}
216
}
217
228
sub validate_query_parameters {
218
sub validate_query_parameters {
229
    my ( $c, $action_spec ) = @_;
219
    my ( $c, $action_spec ) = @_;
230
220
231
- 

Return to bug 22071