Bug 17565 - REST API: Let user cancel reserve according to CanReserveBeCanceledFromOpac
Summary: REST API: Let user cancel reserve according to CanReserveBeCanceledFromOpac
Status: BLOCKED
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Lari Taskula
QA Contact:
URL:
Keywords:
Depends on: 17479 17431
Blocks:
  Show dependency treegraph
 
Reported: 2016-11-07 12:36 UTC by Lari Taskula
Modified: 2017-09-25 18:04 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 17565: REST API: Let user cancel reserve according to CanReserveBeCanceledFromOpac (5.35 KB, patch)
2016-11-07 14:50 UTC, Lari Taskula
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17565: REST API: Let user cancel reserve according to CanReserveBeCanceledFromOpac (5.42 KB, patch)
2017-01-17 20:08 UTC, Josef Moravec
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Lari Taskula 2016-11-07 12:36:55 UTC
Currently REST API does not allow hold cancellation for an OPAC user. Only users with reserveforothers have ability to make cancellations.

Let user cancel reserve according to CanReserveBeCanceledFromOpac
Comment 1 Lari Taskula 2016-11-07 14:50:06 UTC
Created attachment 57264 [details] [review]
Bug 17565: REST API: Let user cancel reserve according to CanReserveBeCanceledFromOpac

This patch adds ability for patron to cancel their own holds.

To test:
1. Make sure you have patches from dependant bugs.
2. Apply this patch.
3. Place a hold for a patron that has no permissions.
4. Set hold to Waiting or Transfer status (found => 'W' or 'T' in database).
5. Login with that patron (and get their CGISESSID for cURL).
6. Test DELETE operation for the reserve_id that you just created, e.g.
   with cURL:

   curl -X DELETE -H "Content-Type: application/json" \
   --cookie 'CGISESSID=0230cb985c4fb5844f71ba41f76a0ced' \
   http://yourlib/api/v1/holds/4621
7. Observe HTTP 403 code and following error message:
   "Hold is already in transfer or waiting and cannot be cancelled by patron."
8. Reset hold's "found"-status in database.
9. Run the same cURL command as in step 6.
10. Observe HTTP 200 code and empty object as return.
11. Test DELETE operation for any other reserve_id, e.g. with cURL

   curl -X DELETE -H "Content-Type: application/json" \
   --cookie 'CGISESSID=0230cb985c4fb5844f71ba41f76a0ced' \
   http://yourlib/api/v1/holds/123
12. Observe permission required error.
13. Run t/db_dependent/api/v1/holds.t
Comment 2 Josef Moravec 2017-01-17 20:08:36 UTC
Created attachment 59098 [details] [review]
[SIGNED-OFF] Bug 17565: REST API: Let user cancel reserve according to CanReserveBeCanceledFromOpac

This patch adds ability for patron to cancel their own holds.

To test:
1. Make sure you have patches from dependant bugs.
2. Apply this patch.
3. Place a hold for a patron that has no permissions.
4. Set hold to Waiting or Transfer status (found => 'W' or 'T' in database).
5. Login with that patron (and get their CGISESSID for cURL).
6. Test DELETE operation for the reserve_id that you just created, e.g.
   with cURL:

   curl -X DELETE -H "Content-Type: application/json" \
   --cookie 'CGISESSID=0230cb985c4fb5844f71ba41f76a0ced' \
   http://yourlib/api/v1/holds/4621
7. Observe HTTP 403 code and following error message:
   "Hold is already in transfer or waiting and cannot be cancelled by patron."
8. Reset hold's "found"-status in database.
9. Run the same cURL command as in step 6.
10. Observe HTTP 200 code and empty object as return.
11. Test DELETE operation for any other reserve_id, e.g. with cURL

   curl -X DELETE -H "Content-Type: application/json" \
   --cookie 'CGISESSID=0230cb985c4fb5844f71ba41f76a0ced' \
   http://yourlib/api/v1/holds/123
12. Observe permission required error.
13. Run t/db_dependent/api/v1/holds.t

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 3 Marcel de Rooy 2017-06-16 08:32:54 UTC
Depends on a bug in FQA