@@ -, +, @@ endpoint - Adding a check for the presence of the Authorization header in the - The Auth#under sub is changed so it doesn't go through the - Original tests are generalized so they are run in both ways, with the - Apply the unit tests patch - Run: $ kshell k$ prove t/db_dependent/api/v1/oauth.t - Apply this patch - Run: k$ prove t/db_dependent/api/v1/oauth.t - Sign off :-D --- Koha/REST/V1/Auth.pm | 8 +++++++- Koha/REST/V1/OAuth.pm | 22 ++++++++++++++++++++-- 2 files changed, 27 insertions(+), 3 deletions(-) --- a/Koha/REST/V1/Auth.pm +++ a/Koha/REST/V1/Auth.pm @@ -71,7 +71,13 @@ sub under { "Configuration prevents the usage of this endpoint by unprivileged users"); } - $status = authenticate_api_request($c); + if ( $c->req->url->to_string eq '/api/v1/oauth/token' ) { + # Requesting a token shouldn't go through the API authenticaction chain + $status = 1; + } + else { + $status = authenticate_api_request($c); + } } catch { unless (blessed($_)) { --- a/Koha/REST/V1/OAuth.pm +++ a/Koha/REST/V1/OAuth.pm @@ -21,6 +21,7 @@ use Module::Load::Conditional; use C4::Context; use Koha::OAuth; +use MIME::Base64; use Mojo::Base 'Mojolicious::Controller'; @@ -53,8 +54,25 @@ sub token { return $c->render(status => 400, openapi => {error => 'Unimplemented grant type'}); } - my $client_id = $c->validation->param('client_id'); - my $client_secret = $c->validation->param('client_secret'); + my $client_id; + my $client_secret; + + my $authorization_header = $c->req->headers->authorization; + + if ( $authorization_header and $authorization_header =~ /^Basic / ) { + my ( $type, $credentials ) = split / /, $authorization_header; + + unless ($credentials) { + Koha::Exceptions::Authentication::Required->throw( error => 'Authentication failure.' ); + } + + my $decoded_credentials = decode_base64( $credentials ); + ( $client_id, $client_secret ) = split( /:/, $decoded_credentials, 2 ); + } + else { + $client_id = $c->validation->param('client_id'); + $client_secret = $c->validation->param('client_secret'); + } my $cb = "${grant_type}_grant"; my $server = Net::OAuth2::AuthorizationServer->new; --