X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/0c524b240858303b40078608dd76a1b2b6023b47..98b4d62462040deb0d3564808917f69cc723c3a3:/app/controllers/api_controller.rb diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb index 83a35e15f..17c98fe8b 100644 --- a/app/controllers/api_controller.rb +++ b/app/controllers/api_controller.rb @@ -1,6 +1,10 @@ class ApiController < ApplicationController skip_before_action :verify_authenticity_token + before_action :check_api_readable + + around_action :api_call_handle_error, :api_call_timeout + private ## @@ -45,15 +49,15 @@ class ApiController < ApplicationController end end - def authorize(realm = "Web Password", errormessage = "Couldn't authenticate you") + def authorize(errormessage = "Couldn't authenticate you") # make the current_user object from any auth sources we have setup_user_auth # handle authenticate pass/fail unless current_user # no auth, the user does not exist or the password was wrong - response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" render :plain => errormessage, :status => :unauthorized + false end end @@ -62,24 +66,19 @@ class ApiController < ApplicationController # Use capabilities from the oauth token if it exists and is a valid access token if doorkeeper_token&.accessible? ApiAbility.new(nil).merge(ApiCapability.new(doorkeeper_token)) - elsif Authenticator.new(self, [:token]).allow? - ApiAbility.new(nil).merge(ApiCapability.new(current_token)) else ApiAbility.new(current_user) end end def deny_access(_exception) - if doorkeeper_token || current_token + if doorkeeper_token set_locale report_error t("oauth.permissions.missing"), :forbidden elsif current_user head :forbidden else - realm = "Web Password" - errormessage = "Couldn't authenticate you" - response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" - render :plain => errormessage, :status => :unauthorized + head :unauthorized end end @@ -94,24 +93,9 @@ class ApiController < ApplicationController # from the authorize method, but can be called elsewhere if authorisation # is optional. def setup_user_auth + logger.info " setup_user_auth" # try and setup using OAuth - if doorkeeper_token&.accessible? - self.current_user = User.find(doorkeeper_token.resource_owner_id) - elsif Authenticator.new(self, [:token]).allow? - # self.current_user setup by OAuth - else - username, passwd = auth_data # parse from headers - # authenticate per-scheme - self.current_user = if username.nil? - nil # no authentication provided - perhaps first connect (client should retry after 401) - elsif username == "token" - User.authenticate(:token => passwd) # preferred - random token for user from db, passed in basic auth - else - User.authenticate(:username => username, :password => passwd) # basic auth - end - # log if we have authenticated using basic auth - logger.info "Authenticated as user #{current_user.id} using basic authentication" if current_user - end + self.current_user = User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token&.accessible? # have we identified the user? if current_user @@ -135,4 +119,55 @@ class ApiController < ApplicationController end end end + + def api_call_handle_error + yield + rescue ActionController::UnknownFormat + head :not_acceptable + rescue ActiveRecord::RecordNotFound => e + head :not_found + rescue LibXML::XML::Error, ArgumentError => e + report_error e.message, :bad_request + rescue ActiveRecord::RecordInvalid => e + message = "#{e.record.class} #{e.record.id}: " + e.record.errors.each { |error| message << "#{error.attribute}: #{error.message} (#{e.record[error.attribute].inspect})" } + report_error message, :bad_request + rescue OSM::APIError => e + report_error e.message, e.status + rescue AbstractController::ActionNotFound, CanCan::AccessDenied => e + raise + rescue StandardError => e + logger.info("API threw unexpected #{e.class} exception: #{e.message}") + e.backtrace.each { |l| logger.info(l) } + report_error "#{e.class}: #{e.message}", :internal_server_error + end + + ## + # wrap an api call in a timeout + def api_call_timeout(&) + Timeout.timeout(Settings.api_timeout, &) + rescue ActionView::Template::Error => e + e = e.cause + + if e.is_a?(Timeout::Error) || + (e.is_a?(ActiveRecord::StatementInvalid) && e.message.include?("execution expired")) + ActiveRecord::Base.connection.raw_connection.cancel + raise OSM::APITimeoutError + else + raise + end + rescue Timeout::Error + ActiveRecord::Base.connection.raw_connection.cancel + raise OSM::APITimeoutError + end + + ## + # check the api change rate limit + def check_rate_limit(new_changes = 1) + max_changes = ActiveRecord::Base.connection.select_value( + "SELECT api_rate_limit($1)", "api_rate_limit", [current_user.id] + ) + + raise OSM::APIRateLimitExceeded if new_changes > max_changes + end end