@@ -, +, @@ OpenAPI --- Koha/REST/Plugin/Query.pm | 35 +++++++++++++++++++++++++++++++++++ Koha/REST/V1/Auth.pm | 3 +++ 2 files changed, 38 insertions(+) --- a/Koha/REST/Plugin/Query.pm +++ a/Koha/REST/Plugin/Query.pm @@ -143,6 +143,41 @@ is raised. return $params; } ); + +=head3 stash_embed + + $c->stash_embed( $c->match->endpoint->pattern->defaults->{'openapi.op_spec'} ); + +=cut + + $app->helper( + 'stash_embed' => sub { + + my ( $c, $spec ) = @_; + + my $embed_spec = $spec->{'x-koha-embed'}; + my $embed_header = $c->req->headers->header('x-koha-embed'); + + Koha::Exceptions::WrongParameter->throw("Embedding objects is not allowed on this endpoint") + if $embed_header and !defined $embed_spec; + + my @to_embed; + foreach my $embed_req ( split /\s*,\s*/, $embed_header ) { + my $matches = grep {lc $_ eq lc $embed_req} @{ $embed_req }; + + Koha::Exceptions::WrongParameter->throw( + error => 'Embeding '.$embed_req. ' is not authorised. Check your x-koha-embed headers or remove it.' + ) unless $matches; + + push @to_embed, $embed_req; + } + + $c->stash( 'koha.embed' => \@to_embed ) + if scalar @to_embed > 0; + + return $c; + } + ); } =head2 Internal methods --- a/Koha/REST/V1/Auth.pm +++ a/Koha/REST/V1/Auth.pm @@ -137,6 +137,9 @@ sub authenticate_api_request { my $user; my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'}; + + $c->stash_embed( $spec ); + my $authorization = $spec->{'x-koha-authorization'}; my $authorization_header = $c->req->headers->authorization; --