Skip intermediate login page with single provider

[bookstack] / app / Http / Middleware / ApiAuthenticate.php

diff --git a/app/Http/Middleware/ApiAuthenticate.php b/app/Http/Middleware/ApiAuthenticate.php
index 15962b3b00471d1fc55dd2a229824b50319886d6..5d621ac119a22abf16c103d4cfc40dc617fcb5e8 100644 (file)
--- a/app/Http/Middleware/ApiAuthenticate.php
+++ b/app/Http/Middleware/ApiAuthenticate.php
@@ -9,8 +9,6 @@ use Illuminate\Http\Request;
 
 class ApiAuthenticate
 {
 
 class ApiAuthenticate
 {

-    use ChecksForEmailConfirmation;
-

     /**
      * Handle an incoming request.
      */
     /**
      * Handle an incoming request.
      */


@@ -29,17 +27,18 @@ class ApiAuthenticate
     /**
      * Ensure the current user can access authenticated API routes, either via existing session
      * authentication or via API Token authentication.
     /**
      * Ensure the current user can access authenticated API routes, either via existing session
      * authentication or via API Token authentication.

+     *

      * @throws UnauthorizedException
      */
     protected function ensureAuthorizedBySessionOrToken(): void
     {
         // Return if the user is already found to be signed in via session-based auth.
         // This is to make it easy to browser the API via browser after just logging into the system.
      * @throws UnauthorizedException
      */
     protected function ensureAuthorizedBySessionOrToken(): void
     {
         // Return if the user is already found to be signed in via session-based auth.
         // This is to make it easy to browser the API via browser after just logging into the system.

-        if (signedInUser()) {
-            $this->ensureEmailConfirmedIfRequested();
-            if (!auth()->user()->can('access-api')) {
+        if (signedInUser() || session()->isStarted()) {
+            if (!$this->sessionUserHasApiAccess()) {

                 throw new ApiAuthException(trans('errors.api_user_no_api_permission'), 403);
             }
                 throw new ApiAuthException(trans('errors.api_user_no_api_permission'), 403);
             }

+

             return;
         }
 
             return;
         }
 


@@ -48,7 +47,16 @@ class ApiAuthenticate
 
         // Validate the token and it's users API access
         auth()->authenticate();
 
         // Validate the token and it's users API access
         auth()->authenticate();

-        $this->ensureEmailConfirmedIfRequested();
+    }
+
+    /**
+     * Check if the active session user has API access.
+     */
+    protected function sessionUserHasApiAccess(): bool
+    {
+        $hasApiPermission = user()->can('access-api');
+
+        return $hasApiPermission && hasAppAccess();

     }
 
     /**
     }
 
     /**


@@ -58,9 +66,9 @@ class ApiAuthenticate
     {
         return response()->json([
             'error' => [
     {
         return response()->json([
             'error' => [

-                'code' => $code,
+                'code'    => $code,

                 'message' => $message,
                 'message' => $message,

-            ]
+            ],

         ], $code);
     }
 }
         ], $code);
     }
 }