Skip to content

Commit 5f4871b

Browse files
author
Korshenko, Oleksii(okorshenko)
committed
Merge pull request #373 from magento-api/MAGETWO-43020-Implement-Authorization-For-SOAP-And-REST-Schemas
[API] WSDL Authentication
2 parents 23b962f + 14ee44f commit 5f4871b

File tree

34 files changed

+392
-280
lines changed

34 files changed

+392
-280
lines changed

‎app/code/Magento/Swagger/view/frontend/layout/swagger_index_index.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
<link src='Magento_Swagger::swagger-ui/js/lang/translator.js' type='text/javascript'/>
3030
<link src='Magento_Swagger::swagger-ui/js/lang/ru.js' type='text/javascript'/>
3131
<link src='Magento_Swagger::swagger-ui/js/lang/en.js' type='text/javascript'/>
32+
<link src='Magento_Swagger::swagger-ui/js/magento-swagger.js' type='text/javascript'/>
3233

3334
<!--Remove require-js assets-->
3435
<remove src="requirejs/require.js"/>

‎app/code/Magento/Swagger/view/frontend/templates/swagger-ui/index.phtml

Lines changed: 5 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -17,84 +17,14 @@
1717
$schemaUrl = rtrim($block->getBaseUrl(), '/') . '/rest/default/schema?services=all';
1818
?>
1919

20-
<!DOCTYPE html>
21-
<script>
22-
$(function () {
23-
var url = window.location.search.match(/url=([^&]+)/);
24-
if (url && url.length > 1) {
25-
url = decodeURIComponent(url[1]);
26-
} else {
27-
url = '<?php /* @escapeNotVerified */ echo $schemaUrl ?>';
28-
}
29-
30-
// Pre load translate...
31-
if(window.SwaggerTranslator) {
32-
window.SwaggerTranslator.translate();
33-
}
34-
window.swaggerUi = new SwaggerUi({
35-
url: url,
36-
dom_id: "swagger-ui-container",
37-
supportedSubmitMethods: ['get', 'post', 'put', 'delete', 'patch'],
38-
onComplete: function(swaggerApi, swaggerUi){
39-
if(typeof initOAuth == "function") {
40-
initOAuth({
41-
clientId: "your-client-id",
42-
clientSecret: "your-client-secret",
43-
realm: "your-realms",
44-
appName: "your-app-name",
45-
scopeSeparator: ","
46-
});
47-
}
48-
49-
if(window.SwaggerTranslator) {
50-
window.SwaggerTranslator.translate();
51-
}
52-
53-
$('pre code').each(function(i, e) {
54-
hljs.highlightBlock(e)
55-
});
56-
57-
addApiKeyAuthorization();
58-
},
59-
onFailure: function(data) {
60-
log("Unable to Load SwaggerUI");
61-
},
62-
docExpansion: "none",
63-
apisSorter: "alpha",
64-
showRequestHeaders: false
65-
});
66-
67-
function addApiKeyAuthorization(){
68-
var key = encodeURIComponent($('#input_apiKey')[0].value);
69-
if(key && key.trim() != "") {
70-
var apiKeyAuth = new SwaggerClient.ApiKeyAuthorization("api_key", key, "query");
71-
window.swaggerUi.api.clientAuthorizations.add("api_key", apiKeyAuth);
72-
log("added key " + key);
73-
}
74-
}
75-
76-
$('#input_apiKey').change(addApiKeyAuthorization);
77-
78-
// if you have an apiKey you would like to pre-populate on the page for demonstration purposes...
79-
/*
80-
var apiKey = "myApiKeyXXXX123456789";
81-
$('#input_apiKey').val(apiKey);
82-
*/
83-
84-
window.swaggerUi.load();
85-
86-
function log() {
87-
if ('console' in window) {
88-
console.log.apply(console, arguments);
89-
}
90-
}
91-
});
92-
</script>
93-
94-
9520
<div id='header'>
9621
<div class="swagger-ui-wrap">
9722
<a id="logo" href="http://swagger.io">swagger</a>
23+
<form id='api_selector'>
24+
<input id="input_baseUrl" type="hidden" value="<?php /* @escapeNotVerified */ echo $schemaUrl ?>"/>
25+
<div class='input'><input placeholder="api_key" id="input_apiKey" name="apiKey" type="text"/></div>
26+
<div class='input'><a id="explore" href="#" data-sw-translate>apply</a></div>
27+
</form>
9828
</div>
9929
</div>
10030

‎app/code/Magento/Swagger/view/frontend/web/swagger-ui/js/magento-swagger.js

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
/**
2+
* Copyright © 2015 Magento. All rights reserved.
3+
* See COPYING.txt for license details.
4+
*/
5+
$(function () {
6+
var url = $('#input_baseUrl').val();
7+
8+
// Pre load translate...
9+
if(window.SwaggerTranslator) {
10+
window.SwaggerTranslator.translate();
11+
}
12+
window.swaggerUi = new SwaggerUi({
13+
url: url,
14+
dom_id: "swagger-ui-container",
15+
supportedSubmitMethods: ['get', 'post', 'put', 'delete', 'patch'],
16+
onComplete: function(swaggerApi, swaggerUi){
17+
if(typeof initOAuth == "function") {
18+
initOAuth({
19+
clientId: "your-client-id",
20+
clientSecret: "your-client-secret",
21+
realm: "your-realms",
22+
appName: "your-app-name",
23+
scopeSeparator: ","
24+
});
25+
}
26+
27+
if(window.SwaggerTranslator) {
28+
window.SwaggerTranslator.translate();
29+
}
30+
31+
$('pre code').each(function(i, e) {
32+
hljs.highlightBlock(e)
33+
});
34+
35+
addApiKeyAuthorization();
36+
},
37+
onFailure: function(data) {
38+
log("Unable to Load SwaggerUI");
39+
},
40+
docExpansion: "none",
41+
apisSorter: "alpha",
42+
showRequestHeaders: false
43+
});
44+
45+
function addApiKeyAuthorization(){
46+
var key = encodeURIComponent($('#input_apiKey')[0].value);
47+
if(key && key.trim() != "") {
48+
var apiKeyAuth = new SwaggerClient.ApiKeyAuthorization("Authorization", "Bearer " + key, "header");
49+
window.swaggerUi.api.clientAuthorizations.add("apiKeyAuth", apiKeyAuth);
50+
}
51+
}
52+
53+
$('#input_apiKey').change(addApiKeyAuthorization);
54+
55+
56+
window.swaggerUi.load();
57+
58+
function log() {
59+
if ('console' in window) {
60+
console.log.apply(console, arguments);
61+
}
62+
}
63+
});

‎app/code/Magento/Swagger/view/frontend/web/swagger-ui/js/swagger-ui.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -427,7 +427,7 @@
427427
},"22":function(depth0,helpers,partials,data) {
428428
return "";
429429
},"24":function(depth0,helpers,partials,data) {
430-
return " <div class='sandbox_header'>\n <input class='submit' type='hidden' value='Try it out!' data-sw-translate/>\n <a href='#' class='response_hider' style='display:none' data-sw-translate>Hide Response</a>\n <span class='response_throbber' style='display:none'></span>\n </div>\n";
430+
return " <div class='sandbox_header'>\n <input class='submit' type='button' value='Try it out!' data-sw-translate/>\n <a href='#' class='response_hider' style='display:none' data-sw-translate>Hide Response</a>\n <span class='response_throbber' style='display:none'></span>\n </div>\n";
431431
},"26":function(depth0,helpers,partials,data) {
432432
return " <h4 data-sw-translate>Request Headers</h4>\n <div class='block request_headers'></div>\n";
433433
},"compiler":[6,">= 2.0.0-beta.1"],"main":function(depth0,helpers,partials,data) {

‎app/code/Magento/Webapi/Controller/Rest.php

Lines changed: 8 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
*/
66
namespace Magento\Webapi\Controller;
77

8-
use Magento\Framework\AuthorizationInterface;
8+
use Magento\Framework\Webapi\Authorization;
99
use Magento\Framework\Exception\AuthorizationException;
1010
use Magento\Framework\Webapi\ErrorProcessor;
1111
use Magento\Framework\Webapi\Request;
@@ -52,8 +52,8 @@ class Rest implements \Magento\Framework\App\FrontControllerInterface
5252
/** @var \Magento\Framework\App\State */
5353
protected $_appState;
5454

55-
/** @var AuthorizationInterface */
56-
protected $_authorization;
55+
/** @var Authorization */
56+
protected $authorization;
5757

5858
/** @var ServiceInputProcessor */
5959
protected $serviceInputProcessor;
@@ -93,7 +93,7 @@ class Rest implements \Magento\Framework\App\FrontControllerInterface
9393
* @param Router $router
9494
* @param \Magento\Framework\ObjectManagerInterface $objectManager
9595
* @param \Magento\Framework\App\State $appState
96-
* @param AuthorizationInterface $authorization
96+
* @param Authorization $authorization
9797
* @param ServiceInputProcessor $serviceInputProcessor
9898
* @param ErrorProcessor $errorProcessor
9999
* @param PathProcessor $pathProcessor
@@ -113,7 +113,7 @@ public function __construct(
113113
Router $router,
114114
\Magento\Framework\ObjectManagerInterface $objectManager,
115115
\Magento\Framework\App\State $appState,
116-
AuthorizationInterface $authorization,
116+
Authorization $authorization,
117117
ServiceInputProcessor $serviceInputProcessor,
118118
ErrorProcessor $errorProcessor,
119119
PathProcessor $pathProcessor,
@@ -129,7 +129,7 @@ public function __construct(
129129
$this->_response = $response;
130130
$this->_objectManager = $objectManager;
131131
$this->_appState = $appState;
132-
$this->_authorization = $authorization;
132+
$this->authorization = $authorization;
133133
$this->serviceInputProcessor = $serviceInputProcessor;
134134
$this->_errorProcessor = $errorProcessor;
135135
$this->_pathProcessor = $pathProcessor;
@@ -198,30 +198,14 @@ protected function getCurrentRoute()
198198
protected function checkPermissions()
199199
{
200200
$route = $this->getCurrentRoute();
201-
if (!$this->isAllowed($route->getAclResources())) {
201+
if (!$this->authorization->isAllowed($route->getAclResources())) {
202202
$params = ['resources' => implode(', ', $route->getAclResources())];
203203
throw new AuthorizationException(
204204
__(AuthorizationException::NOT_AUTHORIZED, $params)
205205
);
206206
}
207207
}
208208

209-
/**
210-
* Check if all ACL resources are allowed to be accessed by current API user.
211-
*
212-
* @param string[] $aclResources
213-
* @return bool
214-
*/
215-
protected function isAllowed($aclResources)
216-
{
217-
foreach ($aclResources as $resource) {
218-
if (!$this->_authorization->isAllowed($resource)) {
219-
return false;
220-
}
221-
}
222-
return true;
223-
}
224-
225209
/**
226210
* Execute schema request
227211
*
@@ -231,7 +215,7 @@ protected function processSchemaRequest()
231215
{
232216
$requestedServices = $this->_request->getRequestedServices('all');
233217
$requestedServices = $requestedServices == Request::ALL_SERVICES
234-
? array_keys($this->swaggerGenerator->getListOfServices())
218+
? $this->swaggerGenerator->getListOfServices()
235219
: $requestedServices;
236220
$responseBody = $this->swaggerGenerator->generate(
237221
$requestedServices,

‎app/code/Magento/Webapi/Controller/Soap.php

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@
77
*/
88
namespace Magento\Webapi\Controller;
99

10-
use Magento\Framework\Exception\AuthorizationException;
1110
use Magento\Framework\Webapi\ErrorProcessor;
1211
use Magento\Framework\Webapi\Request;
1312
use Magento\Framework\Webapi\Response;
@@ -171,25 +170,6 @@ protected function _isWsdlListRequest()
171170
return $this->_request->getParam(\Magento\Webapi\Model\Soap\Server::REQUEST_PARAM_LIST_WSDL) !== null;
172171
}
173172

174-
/**
175-
* Parse the Authorization header and return the access token e.g. Authorization: Bearer <access-token>
176-
*
177-
* @return string Access token
178-
* @throws AuthorizationException
179-
*/
180-
protected function _getAccessToken()
181-
{
182-
$headers = array_change_key_case(getallheaders(), CASE_UPPER);
183-
if (isset($headers['AUTHORIZATION'])) {
184-
$token = explode(' ', $headers['AUTHORIZATION']);
185-
if (isset($token[1]) && is_string($token[1])) {
186-
return $token[1];
187-
}
188-
throw new AuthorizationException(__('Authentication header format is invalid.'));
189-
}
190-
throw new AuthorizationException(__('Authentication header is absent.'));
191-
}
192-
193173
/**
194174
* Set body and status code to response using information extracted from provided exception.
195175
*

‎app/code/Magento/Webapi/Controller/Soap/Request/Handler.php

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
use Magento\Framework\Api\ExtensibleDataInterface;
99
use Magento\Framework\Api\MetadataObjectInterface;
1010
use Magento\Framework\Api\SimpleDataObjectConverter;
11-
use Magento\Framework\AuthorizationInterface;
11+
use Magento\Framework\Webapi\Authorization;
1212
use Magento\Framework\Exception\AuthorizationException;
1313
use Magento\Framework\Reflection\DataObjectProcessor;
1414
use Magento\Framework\Webapi\ServiceInputProcessor;
@@ -38,8 +38,8 @@ class Handler
3838
/** @var SoapConfig */
3939
protected $_apiConfig;
4040

41-
/** @var AuthorizationInterface */
42-
protected $_authorization;
41+
/** @var Authorization */
42+
protected $authorization;
4343

4444
/** @var SimpleDataObjectConverter */
4545
protected $_dataObjectConverter;
@@ -59,7 +59,7 @@ class Handler
5959
* @param SoapRequest $request
6060
* @param \Magento\Framework\ObjectManagerInterface $objectManager
6161
* @param SoapConfig $apiConfig
62-
* @param AuthorizationInterface $authorization
62+
* @param Authorization $authorization
6363
* @param SimpleDataObjectConverter $dataObjectConverter
6464
* @param ServiceInputProcessor $serviceInputProcessor
6565
* @param DataObjectProcessor $dataObjectProcessor
@@ -69,7 +69,7 @@ public function __construct(
6969
SoapRequest $request,
7070
\Magento\Framework\ObjectManagerInterface $objectManager,
7171
SoapConfig $apiConfig,
72-
AuthorizationInterface $authorization,
72+
Authorization $authorization,
7373
SimpleDataObjectConverter $dataObjectConverter,
7474
ServiceInputProcessor $serviceInputProcessor,
7575
DataObjectProcessor $dataObjectProcessor,
@@ -78,7 +78,7 @@ public function __construct(
7878
$this->_request = $request;
7979
$this->_objectManager = $objectManager;
8080
$this->_apiConfig = $apiConfig;
81-
$this->_authorization = $authorization;
81+
$this->authorization = $authorization;
8282
$this->_dataObjectConverter = $dataObjectConverter;
8383
$this->serviceInputProcessor = $serviceInputProcessor;
8484
$this->_dataObjectProcessor = $dataObjectProcessor;
@@ -107,15 +107,7 @@ public function __call($operation, $arguments)
107107
throw new WebapiException(__("Operation allowed only in HTTPS"));
108108
}
109109

110-
$isAllowed = false;
111-
foreach ($serviceMethodInfo[ServiceMetadata::KEY_ACL_RESOURCES] as $resource) {
112-
if ($this->_authorization->isAllowed($resource)) {
113-
$isAllowed = true;
114-
break;
115-
}
116-
}
117-
118-
if (!$isAllowed) {
110+
if (!$this->authorization->isAllowed($serviceMethodInfo[ServiceMetadata::KEY_ACL_RESOURCES])) {
119111
throw new AuthorizationException(
120112
__(
121113
AuthorizationException::NOT_AUTHORIZED,

0 commit comments

Comments
 (0)