class ApiController < ApplicationController
skip_before_action :verify_authenticity_token
+ before_action :check_api_readable
+
+ around_action :api_call_handle_error, :api_call_timeout
+
private
##
end
end
- def authorize(realm = "Web Password", errormessage = "Couldn't authenticate you")
+ def authorize(errormessage: "Couldn't authenticate you", skip_blocks: false, skip_terms: false)
# make the current_user object from any auth sources we have
- setup_user_auth
+ setup_user_auth(:skip_blocks => skip_blocks, :skip_terms => skip_terms)
# handle authenticate pass/fail
unless current_user
# no auth, the user does not exist or the password was wrong
- if Settings.basic_auth_support
- response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\""
- render :plain => errormessage, :status => :unauthorized
- else
- render :plain => errormessage, :status => :forbidden
- end
+ render :plain => errormessage, :status => :unauthorized
false
end
def current_ability
# Use capabilities from the oauth token if it exists and is a valid access token
if doorkeeper_token&.accessible?
- ApiAbility.new(nil).merge(ApiCapability.new(doorkeeper_token))
- elsif Authenticator.new(self, [:token]).allow?
- ApiAbility.new(nil).merge(ApiCapability.new(current_token))
+ user = User.find(doorkeeper_token.resource_owner_id)
+ scopes = Set.new doorkeeper_token.scopes
+ if scopes.include?("write_api")
+ scopes.add("write_map")
+ scopes.add("write_changeset_comments")
+ scopes.delete("write_api")
+ end
+ ApiAbility.new(user, scopes)
else
- ApiAbility.new(current_user)
+ ApiAbility.new(nil, Set.new)
end
end
def deny_access(_exception)
- if doorkeeper_token || current_token
+ if doorkeeper_token
set_locale
report_error t("oauth.permissions.missing"), :forbidden
- elsif current_user
- head :forbidden
- elsif Settings.basic_auth_support
- realm = "Web Password"
- errormessage = "Couldn't authenticate you"
- response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\""
- render :plain => errormessage, :status => :unauthorized
else
- render :plain => errormessage, :status => :forbidden
+ head :unauthorized
end
end
# sets up the current_user for use by other methods. this is mostly called
# from the authorize method, but can be called elsewhere if authorisation
# is optional.
- def setup_user_auth
+ def setup_user_auth(skip_blocks: false, skip_terms: false)
logger.info " setup_user_auth"
# try and setup using OAuth
- if doorkeeper_token&.accessible?
- self.current_user = User.find(doorkeeper_token.resource_owner_id)
- elsif Authenticator.new(self, [:token]).allow?
- # self.current_user setup by OAuth
- elsif Settings.basic_auth_support
- username, passwd = auth_data # parse from headers
- # authenticate per-scheme
- self.current_user = if username.nil?
- nil # no authentication provided - perhaps first connect (client should retry after 401)
- elsif username == "token"
- User.authenticate(:token => passwd) # preferred - random token for user from db, passed in basic auth
- else
- User.authenticate(:username => username, :password => passwd) # basic auth
- end
- # log if we have authenticated using basic auth
- logger.info "Authenticated as user #{current_user.id} using basic authentication" if current_user
- end
+ self.current_user = User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token&.accessible?
# have we identified the user?
if current_user
# check if the user has been banned
- user_block = current_user.blocks.active.take
- unless user_block.nil?
- set_locale
- if user_block.zero_hour?
- report_error t("application.setup_user_auth.blocked_zero_hour"), :forbidden
- else
- report_error t("application.setup_user_auth.blocked"), :forbidden
+ unless skip_blocks
+ user_block = current_user.blocks.active.take
+ unless user_block.nil?
+ set_locale
+ if user_block.zero_hour?
+ report_error t("application.setup_user_auth.blocked_zero_hour"), :forbidden
+ else
+ report_error t("application.setup_user_auth.blocked"), :forbidden
+ end
end
end
# if the user hasn't seen the contributor terms then don't
# allow editing - they have to go to the web site and see
# (but can decline) the CTs to continue.
- if !current_user.terms_seen && flash[:skip_terms].nil?
+ if !current_user.terms_seen && !skip_terms
set_locale
report_error t("application.setup_user_auth.need_to_see_terms"), :forbidden
end
report_error message, :bad_request
rescue OSM::APIError => e
report_error e.message, e.status
- rescue AbstractController::ActionNotFound => e
+ rescue AbstractController::ActionNotFound, CanCan::AccessDenied => e
raise
rescue StandardError => e
logger.info("API threw unexpected #{e.class} exception: #{e.message}")
report_error "#{e.class}: #{e.message}", :internal_server_error
end
- ##
- # asserts that the request method is the +method+ given as a parameter
- # or raises a suitable error. +method+ should be a symbol, e.g: :put or :get.
- def assert_method(method)
- ok = request.send(:"#{method.to_s.downcase}?")
- raise OSM::APIBadMethodError, method unless ok
- end
-
##
# wrap an api call in a timeout
- def api_call_timeout(&block)
- Timeout.timeout(Settings.api_timeout, &block)
+ def api_call_timeout(&)
+ Timeout.timeout(Settings.api_timeout, &)
rescue ActionView::Template::Error => e
e = e.cause
raise OSM::APIRateLimitExceeded if new_changes > max_changes
end
+
+ def scope_enabled?(scope)
+ doorkeeper_token&.includes_scope?(scope)
+ end
+
+ helper_method :scope_enabled?
end
projects / rails.git / blobdiff