Koha/REST/V1/OAuth.pm

   1 package Koha::REST::V1::OAuth;
   2
   3 # This file is part of Koha.
   4 #
   5 # Koha is free software; you can redistribute it and/or modify it under the
   6 # terms of the GNU General Public License as published by the Free Software
   7 # Foundation; either version 3 of the License, or (at your option) any later
   8 # version.
   9 #
  10 # Koha is distributed in the hope that it will be useful, but WITHOUT ANY
  11 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
  12 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
  13 #
  14 # You should have received a copy of the GNU General Public License along
  15 # with Koha; if not, write to the Free Software Foundation, Inc.,
  16 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  17
  18 use Modern::Perl;
  19
  20 use Module::Load::Conditional;
  21
  22 use C4::Context;
  23 use Koha::OAuth;
  24 use MIME::Base64;
  25
  26 use Mojo::Base 'Mojolicious::Controller';
  27
  28 =head1 NAME
  29
  30 Koha::REST::V1::OAuth - Controller library for handling OAuth2-related token handling
  31
  32 =head2 Operations
  33
  34 =head3 token
  35
  36 Controller method handling token requests
  37
  38 =cut
  39
  40 sub token {
  41
  42     my $c = shift->openapi->valid_input or return;
  43
  44     if ( Module::Load::Conditional::can_load(
  45                 modules => {'Net::OAuth2::AuthorizationServer' => undef} )) {
  46         require Net::OAuth2::AuthorizationServer;
  47     }
  48     else {
  49         return $c->render( status => 400, openapi => { error => 'Unimplemented grant type' } );
  50     }
  51
  52     my $grant_type = $c->validation->param('grant_type');
  53     unless ( $grant_type eq 'client_credentials' and C4::Context->preference('RESTOAuth2ClientCredentials') ) {
  54         return $c->render(status => 400, openapi => {error => 'Unimplemented grant type'});
  55     }
  56
  57     my $client_id;
  58     my $client_secret;
  59
  60     my $authorization_header = $c->req->headers->authorization;
  61
  62     if ( $authorization_header and $authorization_header =~ /^Basic / ) {
  63         my ( $type, $credentials ) = split / /, $authorization_header;
  64
  65         unless ($credentials) {
  66             Koha::Exceptions::Authentication::Required->throw( error => 'Authentication failure.' );
  67         }
  68
  69         my $decoded_credentials = decode_base64( $credentials );
  70         ( $client_id, $client_secret ) = split( /:/, $decoded_credentials, 2 );
  71     }
  72     else {
  73         $client_id = $c->validation->param('client_id');
  74         $client_secret = $c->validation->param('client_secret');
  75     }
  76
  77     my $cb = "${grant_type}_grant";
  78     my $server = Net::OAuth2::AuthorizationServer->new;
  79     my $grant = $server->$cb(Koha::OAuth::config);
  80
  81     # verify a client against known clients
  82     my ( $is_valid, $error ) = $grant->verify_client(
  83         client_id     => $client_id,
  84         client_secret => $client_secret,
  85     );
  86
  87     unless ($is_valid) {
  88         return $c->render(status => 403, openapi => {error => $error});
  89     }
  90
  91     # generate a token
  92     my $token = $grant->token(
  93         client_id => $client_id,
  94         type      => 'access',
  95     );
  96
  97     # store access token
  98     my $expires_in = 3600;
  99     $grant->store_access_token(
 100         client_id    => $client_id,
 101         access_token => $token,
 102         expires_in   => $expires_in,
 103     );
 104
 105     my $response = {
 106         access_token => $token,
 107         token_type => 'Bearer',
 108         expires_in => $expires_in,
 109     };
 110
 111     return $c->render(status => 200, openapi => $response);
 112 }
 113
 114 1;