Perms: Fixed some issues made when adding transactions

[bookstack] / app / Http / Middleware / ApiAuthenticate.php

diff --git a/app/Http/Middleware/ApiAuthenticate.php b/app/Http/Middleware/ApiAuthenticate.php
index 5d621ac119a22abf16c103d4cfc40dc617fcb5e8..5f3ad3168a0bbd3bbd1209996f50067027ce630f 100644 (file)
--- a/app/Http/Middleware/ApiAuthenticate.php
+++ b/app/Http/Middleware/ApiAuthenticate.php
@@ -3,7 +3,6 @@
 namespace BookStack\Http\Middleware;
 
 use BookStack\Exceptions\ApiAuthException;
 namespace BookStack\Http\Middleware;
 
 use BookStack\Exceptions\ApiAuthException;

-use BookStack\Exceptions\UnauthorizedException;

 use Closure;
 use Illuminate\Http\Request;
 
 use Closure;
 use Illuminate\Http\Request;
 


@@ -11,15 +10,13 @@ class ApiAuthenticate
 {
     /**
      * Handle an incoming request.
 {
     /**
      * Handle an incoming request.

+     *
+     * @throws ApiAuthException

      */
     public function handle(Request $request, Closure $next)
     {
         // Validate the token and it's users API access
      */
     public function handle(Request $request, Closure $next)
     {
         // Validate the token and it's users API access

-        try {
-            $this->ensureAuthorizedBySessionOrToken();
-        } catch (UnauthorizedException $exception) {
-            return $this->unauthorisedResponse($exception->getMessage(), $exception->getCode());
-        }
+        $this->ensureAuthorizedBySessionOrToken();

 
         return $next($request);
     }
 
         return $next($request);
     }


@@ -28,13 +25,13 @@ class ApiAuthenticate
      * Ensure the current user can access authenticated API routes, either via existing session
      * authentication or via API Token authentication.
      *
      * Ensure the current user can access authenticated API routes, either via existing session
      * authentication or via API Token authentication.
      *

-     * @throws UnauthorizedException
+     * @throws ApiAuthException

      */
     protected function ensureAuthorizedBySessionOrToken(): void
     {
         // Return if the user is already found to be signed in via session-based auth.
         // This is to make it easy to browser the API via browser after just logging into the system.
      */
     protected function ensureAuthorizedBySessionOrToken(): void
     {
         // Return if the user is already found to be signed in via session-based auth.
         // This is to make it easy to browser the API via browser after just logging into the system.

-        if (signedInUser() || session()->isStarted()) {
+        if (!user()->isGuest() || session()->isStarted()) {

             if (!$this->sessionUserHasApiAccess()) {
                 throw new ApiAuthException(trans('errors.api_user_no_api_permission'), 403);
             }
             if (!$this->sessionUserHasApiAccess()) {
                 throw new ApiAuthException(trans('errors.api_user_no_api_permission'), 403);
             }


@@ -56,19 +53,6 @@ class ApiAuthenticate
     {
         $hasApiPermission = user()->can('access-api');
 
     {
         $hasApiPermission = user()->can('access-api');
 

-        return $hasApiPermission && hasAppAccess();
-    }
-
-    /**
-     * Provide a standard API unauthorised response.
-     */
-    protected function unauthorisedResponse(string $message, int $code)
-    {
-        return response()->json([
-            'error' => [
-                'code'    => $code,
-                'message' => $message,
-            ],
-        ], $code);
+        return $hasApiPermission && user()->hasAppAccess();

     }
 }
     }
 }