Bug 24545: Fix license statements

[srvgit] / Koha / REST / V1 / Auth.pm

diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm
index 71ef60a..02f9dd7 100644 (file)
--- a/Koha/REST/V1/Auth.pm
+++ b/Koha/REST/V1/Auth.pm
@@ -4,18 +4,18 @@ package Koha::REST::V1::Auth;
 #
 # This file is part of Koha.
 #
-# Koha is free software; you can redistribute it and/or modify it under the
-# terms of the GNU General Public License as published by the Free Software
-# Foundation; either version 3 of the License, or (at your option) any later
-# version.
+# Koha is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
 #
-# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
-# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
-# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# Koha is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
 #
-# You should have received a copy of the GNU General Public License along
-# with Koha; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+# You should have received a copy of the GNU General Public License
+# along with Koha; if not, see <http://www.gnu.org/licenses>.
 
 use Modern::Perl;
 
@@ -71,7 +71,13 @@ sub under {
                 "Configuration prevents the usage of this endpoint by unprivileged users");
         }
 
-        $status = authenticate_api_request($c);
+        if ( $c->req->url->to_abs->path eq '/api/v1/oauth/token' ) {
+            # Requesting a token shouldn't go through the API authenticaction chain
+            $status = 1;
+        }
+        else {
+            $status = authenticate_api_request($c);
+        }
 
     } catch {
         unless (blessed($_)) {
@@ -131,6 +137,9 @@ sub authenticate_api_request {
     my $user;
 
     my $spec = $c->match->endpoint->pattern->defaults->{'openapi.op_spec'};
+
+    $c->stash_embed({ spec => $spec });
+
     my $authorization = $spec->{'x-koha-authorization'};
 
     my $authorization_header = $c->req->headers->authorization;
@@ -157,6 +166,7 @@ sub authenticate_api_request {
         if ($valid_token) {
             my $patron_id = Koha::ApiKeys->find( $valid_token->{client_id} )->patron_id;
             $user         = Koha::Patrons->find($patron_id);
+            C4::Context->interface('api');
         }
         else {
             # If we have "Authorization: Bearer" header and oauth authentication
@@ -173,6 +183,7 @@ sub authenticate_api_request {
             );
         }
         $user = $c->_basic_auth( $authorization_header );
+        C4::Context->interface('api');
         unless ( $user ) {
             # If we have "Authorization: Basic" header and authentication
             # failed, do not try other authentication means
@@ -189,7 +200,7 @@ sub authenticate_api_request {
         # Manually pass the remote_address to check_auth_cookie
         my $remote_addr = $c->tx->remote_address;
         my ($status, $sessionID) = check_cookie_auth(
-                                                $cookie, '*',
+                                                $cookie, undef,
                                                 { remote_addr => $remote_addr });
         if ($status eq "ok") {
             my $session = get_session($sessionID);
@@ -229,7 +240,7 @@ sub authenticate_api_request {
 
     my $permissions = $authorization->{'permissions'};
     # Check if the user is authorized
-    if ( haspermission($user->userid, $permissions)
+    if ( ( defined($permissions) and haspermission($user->userid, $permissions) )
         or allow_owner($c, $authorization, $user)
         or allow_guarantor($c, $authorization, $user) ) {
 
@@ -312,7 +323,7 @@ sub allow_guarantor {
         return;
     }
 
-    my $guarantees = $user->guarantees->as_list;
+    my $guarantees = $user->guarantee_relationships->guarantees->as_list;
     foreach my $guarantee (@{$guarantees}) {
         return 1 if check_object_ownership($c, $guarantee);
     }