135/netdisco
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

remove some poor assumptions about api calls

Browse Source
This commit is contained in:
Oliver Gorwits
2019-03-15 13:00:12 +00:00
parent 20f4704fe2
commit 4b8492f4f0
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
lib/App/Netdisco/Web/AuthN.pm
View File

@@ -43,8 +43,7 @@ hook 'before' => sub {
session(logged_in_user_realm => 'users'); session(logged_in_user_realm => 'users');
} }
elsif (setting('api_token_lifetime') elsif (setting('api_token_lifetime')
and (index(request->path, uri_for('/api/')->path) == 0 and request->header('Authorization')) {
or request->path eq uri_for('/swagger.json')->path)) {
my $token = request->header('Authorization'); my $token = request->header('Authorization');
my $user = $provider->validate_api_token($token) my $user = $provider->validate_api_token($token)
@@ -52,6 +51,9 @@ hook 'before' => sub {
session(logged_in_user => $user); session(logged_in_user => $user);
session(logged_in_user_realm => 'users'); session(logged_in_user_realm => 'users');
# you can use Authorization header to get a session cookie,
# but the session is not useful for future API calls.
} }
elsif (setting('no_auth')) { elsif (setting('no_auth')) {
session(logged_in_user => 'guest'); session(logged_in_user => 'guest');
@@ -65,8 +67,7 @@ hook 'before' => sub {
}; };
get qr{^/(?:login(?:/denied)?)?} => sub { get qr{^/(?:login(?:/denied)?)?} => sub {
# FIXME not sure this is the right approach if (param('return_url') and request->header('Authorization')) {
if (param('return_url') and param('return_url') =~ m{^/api/}) {
status('unauthorized'); status('unauthorized');
return to_json { return to_json {
error => 'not authorized', error => 'not authorized',
@@ -160,6 +161,7 @@ post '/login' => sub {
}; };
# ugh, *puke*, but D::P::Swagger has no way to set this with swagger_path # ugh, *puke*, but D::P::Swagger has no way to set this with swagger_path
# must be after the path is declared, above.
Dancer::Plugin::Swagger->instance->doc->{paths}->{'/login'} Dancer::Plugin::Swagger->instance->doc->{paths}->{'/login'}
->{post}->{security}->[0]->{BasicAuth} = []; ->{post}->{security}->[0]->{BasicAuth} = [];