X-Git-Url: http://source.bookstackapp.com/bookstack/blobdiff_plain/3d11cba223cad16ad13faee010259e97b05dcee9..refs/pull/2023/head:/app/Http/Middleware/ApiAuthenticate.php diff --git a/app/Http/Middleware/ApiAuthenticate.php b/app/Http/Middleware/ApiAuthenticate.php index fffbd9ef6..15962b3b0 100644 --- a/app/Http/Middleware/ApiAuthenticate.php +++ b/app/Http/Middleware/ApiAuthenticate.php @@ -3,6 +3,7 @@ namespace BookStack\Http\Middleware; use BookStack\Exceptions\ApiAuthException; +use BookStack\Exceptions\UnauthorizedException; use Closure; use Illuminate\Http\Request; @@ -14,31 +15,40 @@ class ApiAuthenticate * Handle an incoming request. */ public function handle(Request $request, Closure $next) + { + // Validate the token and it's users API access + try { + $this->ensureAuthorizedBySessionOrToken(); + } catch (UnauthorizedException $exception) { + return $this->unauthorisedResponse($exception->getMessage(), $exception->getCode()); + } + + return $next($request); + } + + /** + * Ensure the current user can access authenticated API routes, either via existing session + * authentication or via API Token authentication. + * @throws UnauthorizedException + */ + protected function ensureAuthorizedBySessionOrToken(): void { // Return if the user is already found to be signed in via session-based auth. // This is to make it easy to browser the API via browser after just logging into the system. if (signedInUser()) { - if ($this->awaitingEmailConfirmation()) { - return $this->emailConfirmationErrorResponse($request); + $this->ensureEmailConfirmedIfRequested(); + if (!auth()->user()->can('access-api')) { + throw new ApiAuthException(trans('errors.api_user_no_api_permission'), 403); } - return $next($request); + return; } // Set our api guard to be the default for this request lifecycle. auth()->shouldUse('api'); // Validate the token and it's users API access - try { - auth()->authenticate(); - } catch (ApiAuthException $exception) { - return $this->unauthorisedResponse($exception->getMessage(), $exception->getCode()); - } - - if ($this->awaitingEmailConfirmation()) { - return $this->emailConfirmationErrorResponse($request, true); - } - - return $next($request); + auth()->authenticate(); + $this->ensureEmailConfirmedIfRequested(); } /** @@ -51,6 +61,6 @@ class ApiAuthenticate 'code' => $code, 'message' => $message, ] - ], 401); + ], $code); } }