X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/15e86708f1948d5b07a08bc2a30bf315bab9c07e..5ca24de0d04bef18353d3f0ecdd069d0bca34ce2:/app/controllers/api_controller.rb diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb index ff7f694c5..9b2ee9b53 100644 --- a/app/controllers/api_controller.rb +++ b/app/controllers/api_controller.rb @@ -3,6 +3,8 @@ class ApiController < ApplicationController before_action :check_api_readable + around_action :api_call_handle_error, :api_call_timeout + private ## @@ -47,19 +49,14 @@ class ApiController < ApplicationController end end - def authorize(realm = "Web Password", errormessage = "Couldn't authenticate you") + def authorize(errormessage: "Couldn't authenticate you", skip_blocks: false, skip_terms: false) # make the current_user object from any auth sources we have - setup_user_auth + setup_user_auth(:skip_blocks => skip_blocks, :skip_terms => skip_terms) # handle authenticate pass/fail unless current_user # no auth, the user does not exist or the password was wrong - if Settings.basic_auth_support - response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" - render :plain => errormessage, :status => :unauthorized - else - render :plain => errormessage, :status => :forbidden - end + render :plain => errormessage, :status => :unauthorized false end @@ -68,27 +65,25 @@ class ApiController < ApplicationController def current_ability # Use capabilities from the oauth token if it exists and is a valid access token if doorkeeper_token&.accessible? - ApiAbility.new(nil).merge(ApiCapability.new(doorkeeper_token)) - elsif Authenticator.new(self, [:token]).allow? - ApiAbility.new(nil).merge(ApiCapability.new(current_token)) + user = User.find(doorkeeper_token.resource_owner_id) + scopes = Set.new doorkeeper_token.scopes + if scopes.include?("write_api") + scopes.add("write_map") + scopes.add("write_changeset_comments") + scopes.delete("write_api") + end + ApiAbility.new(user, scopes) else - ApiAbility.new(current_user) + ApiAbility.new(nil, Set.new) end end def deny_access(_exception) - if doorkeeper_token || current_token + if doorkeeper_token set_locale report_error t("oauth.permissions.missing"), :forbidden - elsif current_user - head :forbidden - elsif Settings.basic_auth_support - realm = "Web Password" - errormessage = "Couldn't authenticate you" - response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" - render :plain => errormessage, :status => :unauthorized else - render :plain => errormessage, :status => :forbidden + head :unauthorized end end @@ -102,52 +97,30 @@ class ApiController < ApplicationController # sets up the current_user for use by other methods. this is mostly called # from the authorize method, but can be called elsewhere if authorisation # is optional. - def setup_user_auth + def setup_user_auth(skip_blocks: false, skip_terms: false) logger.info " setup_user_auth" # try and setup using OAuth - if doorkeeper_token&.accessible? - self.current_user = User.find(doorkeeper_token.resource_owner_id) - elsif Authenticator.new(self, [:token]).allow? - if Settings.oauth_10a_support - # self.current_user setup by OAuth - else - report_error t("application.oauth_10a_disabled", :link => t("application.auth_disabled_link")), :forbidden - end - else - username, passwd = auth_data # parse from headers - # authenticate per-scheme - self.current_user = if username.nil? - nil # no authentication provided - perhaps first connect (client should retry after 401) - else - User.authenticate(:username => username, :password => passwd) # basic auth - end - if username && current_user - if Settings.basic_auth_support - # log if we have authenticated using basic auth - logger.info "Authenticated as user #{current_user.id} using basic authentication" - else - report_error t("application.basic_auth_disabled", :link => t("application.auth_disabled_link")), :forbidden - end - end - end + self.current_user = User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token&.accessible? # have we identified the user? if current_user # check if the user has been banned - user_block = current_user.blocks.active.take - unless user_block.nil? - set_locale - if user_block.zero_hour? - report_error t("application.setup_user_auth.blocked_zero_hour"), :forbidden - else - report_error t("application.setup_user_auth.blocked"), :forbidden + unless skip_blocks + user_block = current_user.blocks.active.take + unless user_block.nil? + set_locale + if user_block.zero_hour? + report_error t("application.setup_user_auth.blocked_zero_hour"), :forbidden + else + report_error t("application.setup_user_auth.blocked"), :forbidden + end end end # if the user hasn't seen the contributor terms then don't # allow editing - they have to go to the web site and see # (but can decline) the CTs to continue. - if !current_user.terms_seen && flash[:skip_terms].nil? + if !current_user.terms_seen && !skip_terms set_locale report_error t("application.setup_user_auth.need_to_see_terms"), :forbidden end @@ -168,7 +141,7 @@ class ApiController < ApplicationController report_error message, :bad_request rescue OSM::APIError => e report_error e.message, e.status - rescue AbstractController::ActionNotFound => e + rescue AbstractController::ActionNotFound, CanCan::AccessDenied => e raise rescue StandardError => e logger.info("API threw unexpected #{e.class} exception: #{e.message}") @@ -178,8 +151,8 @@ class ApiController < ApplicationController ## # wrap an api call in a timeout - def api_call_timeout(&block) - Timeout.timeout(Settings.api_timeout, &block) + def api_call_timeout(&) + Timeout.timeout(Settings.api_timeout, &) rescue ActionView::Template::Error => e e = e.cause @@ -204,4 +177,10 @@ class ApiController < ApplicationController raise OSM::APIRateLimitExceeded if new_changes > max_changes end + + def scope_enabled?(scope) + doorkeeper_token&.includes_scope?(scope) + end + + helper_method :scope_enabled? end