_rest_config.php

   1 <?php
   2
   3 /**
   4  * Useful globals class for Rest
   5  *
   6  * @package   OpenEMR
   7  * @link      http://www.open-emr.org
   8  * @author    Jerry Padgett <sjpadgett@gmail.com>
   9  * @author    Brady Miller <brady.g.miller@gmail.com>
  10  * @copyright Copyright (c) 2018 Jerry Padgett <sjpadgett@gmail.com>
  11  * @copyright Copyright (c) 2019 Brady Miller <brady.g.miller@gmail.com>
  12  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  13  */
  14
  15 require_once(dirname(__FILE__) . "/src/Common/Session/SessionUtil.php");
  16
  17 use OpenEMR\Common\Acl\AclMain;
  18 use OpenEMR\RestControllers\AuthRestController;
  19
  20 // also a handy place to add utility methods
  21 //
  22 class RestConfig
  23 {
  24     /** @var set to true to send debug info to the browser */
  25     public static $DEBUG_MODE = false;
  26
  27     /** @var default action is the controller.method fired when no route is specified */
  28     public static $DEFAULT_ACTION = "";
  29
  30     /** @var routemap is an array of patterns and routes */
  31     public static $ROUTE_MAP;
  32
  33     /** @var fhir routemap is an array of patterns and routes */
  34     public static $FHIR_ROUTE_MAP;
  35
  36     /** @var portal routemap is an array of patterns and routes */
  37     public static $PORTAL_ROUTE_MAP;
  38
  39     /** @var portal fhir routemap is an array of patterns and routes */
  40     public static $PORTAL_FHIR_ROUTE_MAP;
  41
  42     /** @var app root is the root directory of the application */
  43     public static $APP_ROOT;
  44
  45     /** @var root url of the application */
  46     public static $ROOT_URL;
  47     public static $REST_FULL_URL;
  48     public static $VENDOR_DIR;
  49     public static $webserver_root;
  50     public static $web_root;
  51     public static $server_document_root;
  52     public static $SITE;
  53
  54     private static $INSTANCE;
  55     private static $IS_INITIALIZED = false;
  56
  57     /**  @var set to true if local api call */
  58     private static $localCall = false;
  59
  60     /**  @var set to true if not rest call */
  61     private static $notRestCall = false;
  62
  63     /** prevents external construction */
  64     private function __construct()
  65     {
  66     }
  67
  68     /** prevents external cloning */
  69     private function __clone()
  70     {
  71     }
  72
  73     /**
  74      * Initialize the RestConfig object
  75      */
  76     static function Init()
  77     {
  78         if (!self::$IS_INITIALIZED) {
  79             self::setPaths();
  80             self::$REST_FULL_URL = $_SERVER['REQUEST_SCHEME'] . "//" . $_SERVER['SERVER_NAME'] . $_SERVER['REDIRECT_URL']; // @todo unsure here!
  81             self::$ROOT_URL = self::$web_root . "/apis";
  82             self::$VENDOR_DIR = self::$webserver_root . "/vendor";
  83             self::$IS_INITIALIZED = true;
  84         }
  85     }
  86
  87     /**
  88      * Returns an instance of the RestConfig singleton
  89      * @return RestConfig
  90      */
  91     static function GetInstance()
  92     {
  93         if (!self::$IS_INITIALIZED) {
  94             self::Init();
  95         }
  96
  97         if (!self::$INSTANCE instanceof self) {
  98             self::$INSTANCE = new self();
  99         }
 100
 101         return self::$INSTANCE;
 102     }
 103
 104
 105     /**
 106      * Basic paths when GLOBALS are not yet available.
 107      * @return none
 108      */
 109     static function SetPaths()
 110     {
 111         $isWindows = stripos(PHP_OS, 'WIN') === 0;
 112         self::$webserver_root = dirname(__FILE__);
 113         if ($isWindows) {
 114             //convert windows path separators
 115             self::$webserver_root = str_replace("\\", "/", self::$webserver_root);
 116         }
 117         // Collect the apache server document root (and convert to windows slashes, if needed)
 118         self::$server_document_root = realpath($_SERVER['DOCUMENT_ROOT']);
 119         if ($isWindows) {
 120             //convert windows path separators
 121             self::$server_document_root = str_replace("\\", "/", self::$server_document_root);
 122         }
 123         self::$web_root = substr(self::$webserver_root, strspn(self::$webserver_root ^ self::$server_document_root, "\0"));
 124         // Ensure web_root starts with a path separator
 125         if (preg_match("/^[^\/]/", self::$web_root)) {
 126             self::$web_root = "/" . self::$web_root;
 127         }
 128     }
 129
 130     static function destroySession()
 131     {
 132         OpenEMR\Common\Session\SessionUtil::apiSessionCookieDestroy();
 133     }
 134
 135     static function getPostData($data)
 136     {
 137         if (count($_POST)) {
 138             return $_POST;
 139         } elseif ($post_data = file_get_contents('php://input')) {
 140             if ($post_json = json_decode($post_data, true)) {
 141                 return $post_json;
 142             } else {
 143                 parse_str($post_data, $post_variables);
 144                 if (count($post_variables)) {
 145                     return $post_variables;
 146                 }
 147             }
 148         }
 149
 150         return false;
 151     }
 152
 153     static function authorization_check($section, $value)
 154     {
 155         $result = AclMain::aclCheckCore($section, $value);
 156         if (!$result) {
 157             if (!self::$notRestCall) {
 158                 http_response_code(401);
 159             }
 160             exit();
 161         }
 162     }
 163
 164     static function setLocalCall()
 165     {
 166         self::$localCall = true;
 167     }
 168
 169     static function setNotRestCall()
 170     {
 171         self::$notRestCall = true;
 172     }
 173
 174     static function is_authentication($resource)
 175     {
 176         return ($resource === "/api/auth" || $resource === "/fhir/auth" || $resource === "/portal/auth" || $resource === "/portalfhir/auth");
 177     }
 178
 179     static function get_bearer_token()
 180     {
 181         $parse = preg_split("/[\s,]+/", $_SERVER["HTTP_AUTHORIZATION"]);
 182         if (strtoupper(trim($parse[0])) !== 'BEARER') {
 183             return false;
 184         }
 185
 186         return trim($parse[1]);
 187     }
 188
 189     static function is_api_request($resource)
 190     {
 191         return (stripos(strtolower($resource), "/api/") !== false) ? true : false;
 192     }
 193
 194     static function is_fhir_request($resource)
 195     {
 196         return (stripos(strtolower($resource), "/fhir/") !== false) ? true : false;
 197     }
 198
 199     static function is_portal_request($resource)
 200     {
 201         return (stripos(strtolower($resource), "/portal/") !== false) ? true : false;
 202     }
 203
 204     static function is_portal_fhir_request($resource)
 205     {
 206         return (stripos(strtolower($resource), "/portalfhir/") !== false) ? true : false;
 207     }
 208
 209     static function verify_api_request($resource, $api)
 210     {
 211         $api = strtolower(trim($api));
 212         if (self::is_fhir_request($resource)) {
 213             if ($api !== 'fhir') {
 214                 http_response_code(401);
 215                 exit();
 216             }
 217         } elseif (self::is_portal_request($resource)) {
 218             if ($api !== 'port') {
 219                 http_response_code(401);
 220                 exit();
 221             }
 222         } elseif (self::is_portal_fhir_request($resource)) {
 223             if ($api !== 'pofh') {
 224                 http_response_code(401);
 225                 exit();
 226             }
 227         } elseif (self::is_api_request($resource)) {
 228             if ($api !== 'oemr') {
 229                 http_response_code(401);
 230                 exit();
 231             }
 232         } else {
 233             // somebody is up to no good
 234             http_response_code(401);
 235             exit();
 236         }
 237
 238         return;
 239     }
 240
 241     static function authentication_check($resource)
 242     {
 243         if (!self::is_authentication($resource)) {
 244             $token = $_SERVER["HTTP_X_API_TOKEN"];
 245             $authRestController = new AuthRestController();
 246             if (!$authRestController->isValidToken($token)) {
 247                 self::destroySession();
 248                 http_response_code(401);
 249                 exit();
 250             } else {
 251                 // Note the isValidToken() set the $_SESSION['authUser'] and $_SESSION['authUserId'] for core/fhir api
 252                 //  or $_SESSION['pid'] for patient portal api/fhir
 253                 $authRestController->optionallyAddMoreTokenTime($token);
 254             }
 255         }
 256     }
 257 }
 258
 259 // Include our routes and init routes global
 260 //
 261 require_once(dirname(__FILE__) . "/_rest_routes.inc.php");