From fa7ae98d1b2e83e88b2861f0826dc89e5b3bbd63 Mon Sep 17 00:00:00 2001
From: Dylan William Hardison <dylan@hardison.net>
Date: Tue, 11 Aug 2015 13:31:49 -0400
Subject: Bug 1184332 - Add Restricted API calls for MozReview

---
 extensions/MozReview/Extension.pm | 55 ++++++++++++++++++++++++++-------------
 1 file changed, 37 insertions(+), 18 deletions(-)

(limited to 'extensions/MozReview/Extension.pm')

diff --git a/extensions/MozReview/Extension.pm b/extensions/MozReview/Extension.pm
index 4e1951ed4..5745cf219 100644
--- a/extensions/MozReview/Extension.pm
+++ b/extensions/MozReview/Extension.pm
@@ -13,10 +13,22 @@ use warnings;
 use parent qw(Bugzilla::Extension);
 
 use Bugzilla::Attachment;
-use Bugzilla::Config::Common;
+use Bugzilla::Error;
+use List::MoreUtils qw( any );
 
 our $VERSION = '0.01';
 
+my @METHOD_WHITELIST = (
+    'User.get',
+    'User.login',
+    'User.valid_login',
+    'Bug.add_comment',
+    'Bug.add_attachment',
+    'Bug.attachments',
+    'Bug.get',
+    'Bug.update_attachment',
+);
+
 sub template_before_process {
     my ($self, $args) = @_;
     my $file = $args->{'file'};
@@ -65,25 +77,32 @@ sub auth_delegation_confirm {
     }
 }
 
-sub config_modify_panels {
+sub config_add_panels {
     my ($self, $args) = @_;
-    push @{ $args->{panels}->{advanced}->{params} }, {
-        name    => 'mozreview_base_url',
-        type    => 't',
-        default => '',
-        checker => \&check_urlbase
-    };
-    push @{ $args->{panels}->{advanced}->{params} }, {
-        name    => 'mozreview_auth_callback_url',
-        type    => 't',
-        default => '',
-        checker => sub {
-            my ($url) = (@_);
-
-            return 'must be an HTTP/HTTPS absolute URL' unless $url =~ m{^https?://};
-            return '';
+    my $modules = $args->{panel_modules};
+    $modules->{MozReview} = "Bugzilla::Extension::MozReview::Config";
+}
+
+sub webservice_before_call {
+    my ($self, $args) = @_;
+    my ($method, $full_method) = ($args->{method}, $args->{full_method});
+    my $mozreview_app_id = Bugzilla->params->{mozreview_app_id};
+    my $user             = Bugzilla->user;
+
+    return unless $mozreview_app_id;
+    return unless $user->authorizer;
+
+    my $getter = $user->authorizer->successful_info_getter()
+      or return;
+
+    return unless $getter->can("app_id") && $getter->app_id;
+
+    my $app_id = $getter->app_id;
+    if ($app_id eq $mozreview_app_id) {
+        unless (any { $full_method eq $_ } @METHOD_WHITELIST) {
+            ThrowCodeError('unknown_method', { method => $full_method });
         }
-    };
+    }
 }
 
 __PACKAGE__->NAME;
-- 
cgit v1.2.3-24-g4f1b