From 876410de46c770c5aa001a629a020f29a282932f Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Mon, 7 Jan 2019 10:24:59 -0300
Subject: [PATCH] Bug 21198: Make authenticate_api_request stash the reason
 access is granted

This patch makes the authenticate_api_request method stash the reason
the request or has been granted access to the resource.

Possible values are:
- permissions
- owner
- guarantor

This will allow the controllers to avoid querying on their own for this
info.

To test:
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/auth_authenticate_api_request.t
=> SUCCESS: Tests pass!
- Sign off :-D
---
 Koha/REST/V1/Auth.pm | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm
index 0fc211f054..0bbbf0c337 100644
--- a/Koha/REST/V1/Auth.pm
+++ b/Koha/REST/V1/Auth.pm
@@ -213,10 +213,21 @@ sub authenticate_api_request {
 
     my $permissions = $authorization->{'permissions'};
     # Check if the user is authorized
-    if ( haspermission($user->userid, $permissions)
-        or allow_owner($c, $authorization, $user)
-        or allow_guarantor($c, $authorization, $user) ) {
+    if ( haspermission($user->userid, $permissions) ) {
+        $c->stash( 'grant_reason', 'permissions' );
+    }
+    else {
+        if ( allow_owner($c, $authorization, $user) ){
+            $c->stash( 'grant_reason', 'owner' );
+        }
+        else {
+            if ( allow_guarantor($c, $authorization, $user) ) {
+                $c->stash( 'grant_reason', 'guarantor' );
+            }
+        }
+    }
 
+    if ( $c->stash('grant_reason') ) {
         validate_query_parameters( $c, $spec );
 
         # Everything is ok
-- 
2.20.1