Bug 13799: Add cookie-based authentication to REST API

[koha.git] / Koha / REST / V1 / Borrowers.pm

diff --git a/Koha/REST/V1/Borrowers.pm b/Koha/REST/V1/Borrowers.pm
index b58ad2a..8857df4 100644 (file)
--- a/Koha/REST/V1/Borrowers.pm
+++ b/Koha/REST/V1/Borrowers.pm
@@ -4,11 +4,17 @@ use Modern::Perl;
 
 use Mojo::Base 'Mojolicious::Controller';
 
+use C4::Auth qw( haspermission );
 use Koha::Borrowers;
 
 sub list_borrowers {
     my ($c, $args, $cb) = @_;
 
+    my $user = $c->stash('koha.user');
+    unless ($user && haspermission($user->userid, {borrowers => 1})) {
+        return $c->$cb({error => "You don't have the required permission"}, 403);
+    }
+
     my $borrowers = Koha::Borrowers->search;
 
     $c->$cb($borrowers->unblessed, 200);
@@ -17,13 +23,21 @@ sub list_borrowers {
 sub get_borrower {
     my ($c, $args, $cb) = @_;
 
-    my $borrower = Koha::Borrowers->find($args->{borrowernumber});
+    my $user = $c->stash('koha.user');
 
-    if ($borrower) {
-        return $c->$cb($borrower->unblessed, 200);
+    unless ( $user
+        && ( $user->borrowernumber == $args->{borrowernumber}
+            || haspermission($user->userid, {borrowers => 1}) ) )
+    {
+        return $c->$cb({error => "You don't have the required permission"}, 403);
+    }
+
+    my $borrower = Koha::Borrowers->find($args->{borrowernumber});
+    unless ($borrower) {
+        return $c->$cb({error => "Borrower not found"}, 404);
     }
 
-    $c->$cb({error => "Borrower not found"}, 404);
+    return $c->$cb($borrower->unblessed, 200);
 }
 
 1;