X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/4b2d3973e82291398931d108e16eacf673e77c16..0a9dc1651e1476c904d9172bf9f522b9b18a779a:/app/controllers/api_controller.rb diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb index c905b24ce..1a8185a3e 100644 --- a/app/controllers/api_controller.rb +++ b/app/controllers/api_controller.rb @@ -1,6 +1,8 @@ class ApiController < ApplicationController skip_before_action :verify_authenticity_token + before_action :check_api_readable + private ## @@ -31,9 +33,8 @@ class ApiController < ApplicationController # as XML for backwards compatibility - all other formats are discarded # which will result in a 406 Not Acceptable response being sent formats = mimetypes.map do |mime| - if mime.symbol == :xml then :xml + if mime.symbol == :xml || mime == "*/*" then :xml elsif mime.symbol == :json then :json - elsif mime == "*/*" then :xml end end else @@ -53,32 +54,39 @@ class ApiController < ApplicationController # handle authenticate pass/fail unless current_user # no auth, the user does not exist or the password was wrong - response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" - render :plain => errormessage, :status => :unauthorized + if Settings.basic_auth_support + response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" + render :plain => errormessage, :status => :unauthorized + else + render :plain => errormessage, :status => :forbidden + end + false end end def current_ability # Use capabilities from the oauth token if it exists and is a valid access token - if Authenticator.new(self, [:token]).allow? - ApiAbility.new(nil).merge(ApiCapability.new(current_token)) + if doorkeeper_token&.accessible? + ApiAbility.new(nil).merge(ApiCapability.new(doorkeeper_token)) else ApiAbility.new(current_user) end end def deny_access(_exception) - if current_token + if doorkeeper_token set_locale report_error t("oauth.permissions.missing"), :forbidden elsif current_user head :forbidden - else + elsif Settings.basic_auth_support realm = "Web Password" errormessage = "Couldn't authenticate you" response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" render :plain => errormessage, :status => :unauthorized + else + render :plain => errormessage, :status => :forbidden end end @@ -93,17 +101,26 @@ class ApiController < ApplicationController # from the authorize method, but can be called elsewhere if authorisation # is optional. def setup_user_auth + logger.info " setup_user_auth" # try and setup using OAuth - unless Authenticator.new(self, [:token]).allow? - username, passwd = get_auth_data # parse from headers + if doorkeeper_token&.accessible? + self.current_user = User.find(doorkeeper_token.resource_owner_id) + else + username, passwd = auth_data # parse from headers # authenticate per-scheme self.current_user = if username.nil? nil # no authentication provided - perhaps first connect (client should retry after 401) - elsif username == "token" - User.authenticate(:token => passwd) # preferred - random token for user from db, passed in basic auth else User.authenticate(:username => username, :password => passwd) # basic auth end + if username && current_user + if Settings.basic_auth_support + # log if we have authenticated using basic auth + logger.info "Authenticated as user #{current_user.id} using basic authentication" + else + report_error t("application.basic_auth_disabled", :link => t("application.auth_disabled_link")), :forbidden + end + end end # have we identified the user? @@ -128,4 +145,55 @@ class ApiController < ApplicationController end end end + + def api_call_handle_error + yield + rescue ActionController::UnknownFormat + head :not_acceptable + rescue ActiveRecord::RecordNotFound => e + head :not_found + rescue LibXML::XML::Error, ArgumentError => e + report_error e.message, :bad_request + rescue ActiveRecord::RecordInvalid => e + message = "#{e.record.class} #{e.record.id}: " + e.record.errors.each { |error| message << "#{error.attribute}: #{error.message} (#{e.record[error.attribute].inspect})" } + report_error message, :bad_request + rescue OSM::APIError => e + report_error e.message, e.status + rescue AbstractController::ActionNotFound => e + raise + rescue StandardError => e + logger.info("API threw unexpected #{e.class} exception: #{e.message}") + e.backtrace.each { |l| logger.info(l) } + report_error "#{e.class}: #{e.message}", :internal_server_error + end + + ## + # wrap an api call in a timeout + def api_call_timeout(&block) + Timeout.timeout(Settings.api_timeout, &block) + rescue ActionView::Template::Error => e + e = e.cause + + if e.is_a?(Timeout::Error) || + (e.is_a?(ActiveRecord::StatementInvalid) && e.message.include?("execution expired")) + ActiveRecord::Base.connection.raw_connection.cancel + raise OSM::APITimeoutError + else + raise + end + rescue Timeout::Error + ActiveRecord::Base.connection.raw_connection.cancel + raise OSM::APITimeoutError + end + + ## + # check the api change rate limit + def check_rate_limit(new_changes = 1) + max_changes = ActiveRecord::Base.connection.select_value( + "SELECT api_rate_limit($1)", "api_rate_limit", [current_user.id] + ) + + raise OSM::APIRateLimitExceeded if new_changes > max_changes + end end