set authorization bearer header from auth_token cookie

.github/workflows/tests.yml

@@ -42,7 +42,10 @@ jobs:
           bin/code-analysis
       - name: Run tests
         run: |
-          TZ=${{ matrix.tz }} bin/test-coverage
+          bin/test-coverage
+        env:
+          PROXY_BEARER_AUTH: on
+          TZ: ${{ matrix.tz }}
       - name: Upload coverage data to coveralls.io
         run: |
           pip install coveralls
@@ -61,4 +64,4 @@ jobs:
         pip install --upgrade coveralls
         coveralls --service=github --finish
       env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CHANGES.rst

@@ -4,7 +4,8 @@ Changelog
 5.0.2 (unreleased)
 ------------------
 
-- Nothing changed yet.
+- set authorization bearer header from auth_token cookie
+  [mamico]
 
 
 5.0.1 (2023-07-04)

README.rst

@@ -206,6 +206,13 @@ Default ISerializeToJsonSummary adapter
 
 This is a patch for backward compatibility for old volto templates that need a full image scales object.
 
+Authentication Header
+---------------------
+
+There is a custom event handler for IPubStart that set authorization bearer header from auth_token cookie.
+For details see the `pull-request <https://github.com/RedTurtle/redturtle.volto/pull/69>`_.
+
+This patch is not enabled by default. You need to set an environment variable to `true`: *PROXY_BEARER_AUTH*.
 
 New Criteria
 ============

base.cfg

@@ -116,3 +116,4 @@ scripts =
 [versions]
 # Don't use a released version of redturtle.volto
 redturtle.volto =
+setuptools = 

src/redturtle/volto/configure.zcml

@@ -42,4 +42,9 @@
       name="redturtle.volto-hiddenprofiles"
       />
 
+  <subscriber
+      for="ZPublisher.interfaces.IPubStart"
+      handler=".events.manage_auth_token"
+      />
+
 </configure>

src/redturtle/volto/events.py

@@ -0,0 +1,18 @@
+import os
+
+
+def manage_auth_token(event):
+    """
+    set authorization header from cookie
+
+    see:
+        https://github.com/plone/plone.restapi/issues/148
+        https://github.com/plone/plone.restapi/pull/1303
+    """
+    if os.environ.get("PROXY_BEARER_AUTH"):
+        request = event.request
+        if getattr(request, "_auth", None):
+            return
+        auth_token = request.cookies.get("auth_token")
+        if auth_token:
+            request._auth = "Bearer " + auth_token