diff --git a/engines/dfc_provider/app/controllers/dfc_provider/api/base_controller.rb b/engines/dfc_provider/app/controllers/dfc_provider/api/base_controller.rb index 0fe7de959b..a896428ba4 100644 --- a/engines/dfc_provider/app/controllers/dfc_provider/api/base_controller.rb +++ b/engines/dfc_provider/app/controllers/dfc_provider/api/base_controller.rb @@ -21,9 +21,7 @@ module DfcProvider end def check_user - @user = authorization_control.process - - return if @user.present? + return if current_user.present? head :unauthorized end @@ -31,12 +29,16 @@ module DfcProvider def check_enterprise @enterprise = if params[:enterprise_id] == 'default' - @user.enterprises.first! + current_user.enterprises.first! else - @user.enterprises.find(params[:enterprise_id]) + current_user.enterprises.find(params[:enterprise_id]) end end + def current_user + @current_user ||= authorization_control.process + end + def access_token request.headers['Authorization'].to_s.split(' ').last end diff --git a/engines/dfc_provider/app/controllers/dfc_provider/api/catalog_items_controller.rb b/engines/dfc_provider/app/controllers/dfc_provider/api/catalog_items_controller.rb index 99cdd9f8ee..6f5111159f 100644 --- a/engines/dfc_provider/app/controllers/dfc_provider/api/catalog_items_controller.rb +++ b/engines/dfc_provider/app/controllers/dfc_provider/api/catalog_items_controller.rb @@ -5,7 +5,7 @@ module DfcProvider module Api class CatalogItemsController < BaseController def index - render json: @user, serializer: DfcProvider::PersonSerializer + render json: current_user, serializer: DfcProvider::PersonSerializer end def show diff --git a/engines/dfc_provider/app/controllers/dfc_provider/api/enterprises_controller.rb b/engines/dfc_provider/app/controllers/dfc_provider/api/enterprises_controller.rb index a7ce0917f1..9a076c98af 100644 --- a/engines/dfc_provider/app/controllers/dfc_provider/api/enterprises_controller.rb +++ b/engines/dfc_provider/app/controllers/dfc_provider/api/enterprises_controller.rb @@ -13,9 +13,9 @@ module DfcProvider def check_enterprise @enterprise = if params[:id] == 'default' - @user.enterprises.first! + current_user.enterprises.first! else - @user.enterprises.find(params[:id]) + current_user.enterprises.find(params[:id]) end end end diff --git a/engines/dfc_provider/app/controllers/dfc_provider/api/people_controller.rb b/engines/dfc_provider/app/controllers/dfc_provider/api/people_controller.rb index 2da4b7c4fe..e0d1a7432c 100644 --- a/engines/dfc_provider/app/controllers/dfc_provider/api/people_controller.rb +++ b/engines/dfc_provider/app/controllers/dfc_provider/api/people_controller.rb @@ -6,20 +6,20 @@ module DfcProvider class PeopleController < BaseController skip_before_action :check_enterprise - before_action :find_user, :check_user_accessibility + before_action :check_user_accessibility def show - render json: @user, serializer: DfcProvider::PersonSerializer + render json: user, serializer: DfcProvider::PersonSerializer end private - def find_user - @retrieved_user = Spree::User.find(params[:id]) + def user + @user ||= Spree::User.find(params[:id]) end def check_user_accessibility - return if @user == @retrieved_user + return if current_user == user not_found end