View | Details | Raw Unified | Return to bug 17479
Collapse All | Expand All

(-)a/Koha/REST/V1/Auth.pm (-2 / +7 lines)
Lines 149-160 sub authenticate_api_request { Link Here
149
149
150
    my $permissions = $authorization->{'permissions'};
150
    my $permissions = $authorization->{'permissions'};
151
    # Check if the user is authorized
151
    # Check if the user is authorized
152
    my ($owner_access, $guarantor_access);
152
    if ( haspermission($user->userid, $permissions)
153
    if ( haspermission($user->userid, $permissions)
153
        or allow_owner($c, $authorization, $user)
154
        or $owner_access = allow_owner($c, $authorization, $user)
154
        or allow_guarantor($c, $authorization, $user) ) {
155
        or $guarantor_access = allow_guarantor($c, $authorization, $user) ) {
155
156
156
        validate_query_parameters( $c, $spec );
157
        validate_query_parameters( $c, $spec );
157
158
159
        # Store information on owner/guarantor access
160
        $c->stash('is_owner_access', 1) if $owner_access;
161
        $c->stash('is_guarantor_access', 1) if $guarantor_access;
162
158
        # Everything is ok
163
        # Everything is ok
159
        return 1;
164
        return 1;
160
    }
165
    }
(-)a/t/db_dependent/api/v1/ownerflag.t (-1 / +130 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/env perl
2
3
# Copyright 2017 Koha-Suomi Oy
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 3 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along
17
# with Koha; if not, write to the Free Software Foundation, Inc.,
18
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19
20
use Modern::Perl;
21
22
use Test::More tests => 3;
23
use Test::Mojo;
24
use t::lib::Mocks;
25
use t::lib::TestBuilder;
26
27
use C4::Auth;
28
use C4::Context;
29
30
use Koha::Database;
31
use Koha::Patrons;
32
33
use Mojolicious::Lite;
34
35
my $schema  = Koha::Database->new->schema;
36
my $builder = t::lib::TestBuilder->new;
37
38
# FIXME: sessionStorage defaults to mysql, but it seems to break transaction handling
39
# this affects the other REST api tests
40
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
41
my $mock = create_test_endpoint();
42
43
my $remote_address = '127.0.0.1';
44
my $t              = Test::Mojo->new('Koha::REST::V1');
45
46
$schema->storage->txn_begin;
47
48
my ($patron, $session) = create_user_and_session(0);
49
my ($guarantor, $session2) = create_user_and_session(0);
50
Koha::Patrons->find($patron->{borrowernumber})
51
             ->guarantorid($guarantor->{borrowernumber})
52
             ->store;
53
my ($librarian, $lib_session) = create_user_and_session(16);
54
55
subtest 'without permission, owner of object tests' => sub {
56
    plan tests => 3;
57
58
    my $borrowernumber = $patron->{borrowernumber};
59
    my $tx = $t->ua->build_tx(GET => "/api/v1/patrons/$borrowernumber");
60
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
61
    $t->request_ok($tx)
62
      ->status_is(418)
63
      ->json_is('/error', 'is_owner_access');
64
};
65
66
67
subtest 'without permissions, guarantor of the owner of the object tests' => sub {
68
    plan tests => 3;
69
70
    my $borrowernumber = $patron->{borrowernumber};
71
    my $tx = $t->ua->build_tx(GET => "/api/v1/patrons/$borrowernumber");
72
    $tx->req->cookies({name => 'CGISESSID', value => $session2->id});
73
    $t->request_ok($tx)
74
      ->status_is(418)
75
      ->json_is('/error', 'is_guarantor_access');
76
};
77
78
subtest 'with permissions tests' => sub {
79
    plan tests => 3;
80
81
    my $borrowernumber = $librarian->{borrowernumber};
82
    my $tx = $t->ua->build_tx(GET => "/api/v1/patrons/$borrowernumber");
83
    $tx->req->cookies({name => 'CGISESSID', value => $lib_session->id});
84
    $t->request_ok($tx)
85
      ->status_is(418)
86
      ->json_is('/error', 'librarian_access');
87
};
88
89
$schema->storage->txn_rollback;
90
91
sub create_test_endpoint {
92
    # Mock Koha::REST::V1::Patron::get to read stash for owner access
93
    my $mock = Test::MockModule->new('Koha::REST::V1::Patron');
94
    $mock->mock(get => sub {
95
        my $c = shift;
96
        if ($c->stash('is_owner_access')) {
97
            return $c->render( status => 418,
98
                               json => { error => "is_owner_access" });
99
        } elsif ($c->stash('is_guarantor_access')) {
100
            return $c->render( status => 418,
101
                               json => { error => "is_guarantor_access" });
102
        }
103
        return $c->render( status => 418,
104
                           json => { error => "librarian_access" });
105
    });
106
    return $mock;
107
}
108
109
sub create_user_and_session {
110
    my ($flags) = @_;
111
112
    my $categorycode = $builder->build({ source => 'Category' })->{ categorycode };
113
    my $branchcode = $builder->build({ source => 'Branch' })->{ branchcode };
114
    my $patron = $builder->build({
115
        source => 'Borrower',
116
        value => {
117
            branchcode   => $branchcode,
118
            categorycode => $categorycode,
119
            flags        => $flags,
120
        }
121
    });
122
    my $session = C4::Auth::get_session('');
123
    $session->param('number', $patron->{ borrowernumber });
124
    $session->param('id', $patron->{ userid });
125
    $session->param('ip', '127.0.0.1');
126
    $session->param('lasttime', time());
127
    $session->flush;
128
129
    return ($patron, $session);
130
}

Return to bug 17479