View | Details | Raw Unified | Return to bug 19405
Collapse All | Expand All

(-)a/t/db_dependent/api/v1/holds.t (-41 / +49 lines)
Lines 65-113 $session_nopermission->param('ip', '127.0.0.1'); Link Here
65
$session_nopermission->param('lasttime', time());
65
$session_nopermission->param('lasttime', time());
66
$session_nopermission->flush;
66
$session_nopermission->flush;
67
67
68
my $borrower = Koha::Patron->new;
68
my $patron_1 = $builder->build_object(
69
$borrower->categorycode( $categorycode );
69
    {
70
$borrower->branchcode( $branchcode );
70
        class => 'Koha::Patrons',
71
$borrower->surname("Test Surname");
71
        value => {
72
$borrower->flags(80); #borrowers and reserveforothers flags
72
            categorycode => $categorycode,
73
$borrower->userid($nopermission->{ userid }."z");
73
            branchcode   => $branchcode,
74
$borrower->store;
74
            surname      => 'Test Surname',
75
my $borrowernumber = $borrower->borrowernumber;
75
            flags        => 80, #borrowers and reserveforothers flags
76
76
        }
77
my $borrower2 = Koha::Patron->new;
77
    }
78
$borrower2->categorycode( $categorycode );
78
);
79
$borrower2->branchcode( $branchcode );
79
80
$borrower2->surname("Test Surname 2");
80
my $patron_2 = $builder->build_object(
81
$borrower2->userid($nopermission->{ userid }."x");
81
    {
82
$borrower2->flags(16); # borrowers flag
82
        class => 'Koha::Patrons',
83
$borrower2->store;
83
        value => {
84
my $borrowernumber2 = $borrower2->borrowernumber;
84
            categorycode => $categorycode,
85
85
            branchcode   => $branchcode,
86
my $borrower3 = Koha::Patron->new;
86
            surname      => 'Test Surname 2',
87
$borrower3->categorycode( $categorycode );
87
            flags        => 16, # borrowers flag
88
$borrower3->branchcode( $branchcode );
88
        }
89
$borrower3->surname("Test Surname 2");
89
    }
90
$borrower3->userid($nopermission->{ userid }."y");
90
);
91
$borrower3->flags(64); # reserveforothers flag
91
92
$borrower3->store;
92
my $patron_3 = $builder->build_object(
93
my $borrowernumber3 = $borrower3->borrowernumber;
93
    {
94
        class => 'Koha::Patrons',
95
        value => {
96
            categorycode => $categorycode,
97
            branchcode   => $branchcode,
98
            surname      => 'Test Surname 3',
99
            flags        => 64, # reserveforothers flag
100
        }
101
    }
102
);
94
103
95
# Get sessions
104
# Get sessions
96
my $session = C4::Auth::get_session('');
105
my $session = C4::Auth::get_session('');
97
$session->param('number', $borrower->borrowernumber);
106
$session->param('number', $patron_1->borrowernumber);
98
$session->param('id', $borrower->userid);
107
$session->param('id', $patron_1->userid);
99
$session->param('ip', '127.0.0.1');
108
$session->param('ip', '127.0.0.1');
100
$session->param('lasttime', time());
109
$session->param('lasttime', time());
101
$session->flush;
110
$session->flush;
102
my $session2 = C4::Auth::get_session('');
111
my $session2 = C4::Auth::get_session('');
103
$session2->param('number', $borrower2->borrowernumber);
112
$session2->param('number', $patron_2->borrowernumber);
104
$session2->param('id', $borrower2->userid);
113
$session2->param('id', $patron_2->userid);
105
$session2->param('ip', '127.0.0.1');
114
$session2->param('ip', '127.0.0.1');
106
$session2->param('lasttime', time());
115
$session2->param('lasttime', time());
107
$session2->flush;
116
$session2->flush;
108
my $session3 = C4::Auth::get_session('');
117
my $session3 = C4::Auth::get_session('');
109
$session3->param('number', $borrower3->borrowernumber);
118
$session3->param('number', $patron_3->borrowernumber);
110
$session3->param('id', $borrower3->userid);
119
$session3->param('id', $patron_3->userid);
111
$session3->param('ip', '127.0.0.1');
120
$session3->param('ip', '127.0.0.1');
112
$session3->param('lasttime', time());
121
$session3->param('lasttime', time());
113
$session3->flush;
122
$session3->flush;
Lines 126-143 $dbh->do('DELETE FROM issuingrules'); Link Here
126
        VALUES (?, ?, ?, ?)
135
        VALUES (?, ?, ?, ?)
127
    }, {}, '*', '*', '*', 1);
136
    }, {}, '*', '*', '*', 1);
128
137
129
my $reserve_id = C4::Reserves::AddReserve($branchcode, $borrowernumber,
138
my $reserve_id = C4::Reserves::AddReserve($branchcode, $patron_1->borrowernumber,
130
    $biblionumber, undef, 1, undef, undef, undef, '', $itemnumber);
139
    $biblionumber, undef, 1, undef, undef, undef, '', $itemnumber);
131
140
132
# Add another reserve to be able to change first reserve's rank
141
# Add another reserve to be able to change first reserve's rank
133
my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $borrowernumber2,
142
my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $patron_2->borrowernumber,
134
    $biblionumber, undef, 2, undef, undef, undef, '', $itemnumber);
143
    $biblionumber, undef, 2, undef, undef, undef, '', $itemnumber);
135
144
136
my $suspend_until = DateTime->now->add(days => 10)->ymd;
145
my $suspend_until = DateTime->now->add(days => 10)->ymd;
137
my $expirationdate = DateTime->now->add(days => 10)->ymd;
146
my $expirationdate = DateTime->now->add(days => 10)->ymd;
138
147
139
my $post_data = {
148
my $post_data = {
140
    borrowernumber => int($borrowernumber),
149
    borrowernumber => int($patron_1->borrowernumber),
141
    biblionumber => int($biblionumber),
150
    biblionumber => int($biblionumber),
142
    itemnumber => int($itemnumber),
151
    itemnumber => int($itemnumber),
143
    branchcode => $branchcode,
152
    branchcode => $branchcode,
Lines 164-174 subtest "Test endpoints without authentication" => sub { Link Here
164
subtest "Test endpoints without permission" => sub {
173
subtest "Test endpoints without permission" => sub {
165
    plan tests => 10;
174
    plan tests => 10;
166
175
167
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber");
176
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
168
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
177
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
169
    $t->request_ok($tx) # no permission
178
    $t->request_ok($tx) # no permission
170
      ->status_is(403);
179
      ->status_is(403);
171
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber");
180
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
172
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
181
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
173
    $t->request_ok($tx) # reserveforothers permission
182
    $t->request_ok($tx) # reserveforothers permission
174
      ->status_is(403);
183
      ->status_is(403);
Lines 261-273 subtest "Test endpoints with permission" => sub { Link Here
261
      ->status_is(404)
270
      ->status_is(404)
262
      ->json_has('/error');
271
      ->json_has('/error');
263
272
264
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=".$borrower->borrowernumber);
273
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
265
    $tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag
274
    $tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag
266
    $t->request_ok($tx)
275
    $t->request_ok($tx)
267
      ->status_is(200)
276
      ->status_is(200)
268
      ->json_is([]);
277
      ->json_is([]);
269
278
270
    my $inexisting_borrowernumber = $borrowernumber2*2;
279
    my $inexisting_borrowernumber = $patron_2->borrowernumber * 2;
271
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$inexisting_borrowernumber");
280
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$inexisting_borrowernumber");
272
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
281
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
273
    $t->request_ok($tx)
282
    $t->request_ok($tx)
Lines 286-292 subtest "Test endpoints with permission" => sub { Link Here
286
      ->json_has('/reserve_id');
295
      ->json_has('/reserve_id');
287
    $reserve_id = $t->tx->res->json->{reserve_id};
296
    $reserve_id = $t->tx->res->json->{reserve_id};
288
297
289
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber");
298
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
290
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
299
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
291
    $t->request_ok($tx)
300
    $t->request_ok($tx)
292
      ->status_is(200)
301
      ->status_is(200)
293
- 

Return to bug 19405