Attachment #144969 for bug #31380

View | Details | Raw Unified | Return to bug 31380
Collapse All | Expand All




package Koha::Auth;

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

use C4::Auth qw//;
use Koha::Patrons;

=head1 NAME

Koha::Auth - Koha class for handling authentication and authorization

=head1 SYNOPSIS

=head2 METHODS

=head3 authenticate

    my $user = Koha::Auth->authenticate({
        sessionID => $sessionID,
    });

Verifies that this user has an authenticated Koha session

=cut

sub authenticate {
    my ($class,$args) = @_;
    my ($auth_user,$auth_session);
    my $sessionID = $args->{sessionID};
    if ($sessionID){
        my $flags;
        my ( $return, $session, $more_info) = C4::Auth::check_cookie_auth($sessionID,$flags,
            { remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 }
        );
        if ($return && $return eq 'ok' && $session){
            my $userid = $session->param('id');
            if ( $userid ){
                my $patron = Koha::Patrons->find({ userid => $userid });
                if ($patron){
                    $auth_user = $patron;
                    $auth_session = $session;
                }
            }
        }
    }
    return ($auth_user,$auth_session);
}

=head3 authorize

    my $flags = Koha::Auth->authorize({
        session => $session,
        flagsrequired => { self_check => 'self_checkout_module' },
    });

=cut

sub authorize {
    my ($class,$args) = @_;
    my $flags = 0;
    my $session = $args->{session};
    my $flagsrequired = $args->{flagsrequired};
    if ($session){
        my $userid = $session->param('id');
        if ($userid){
            $flags = C4::Auth::haspermission($userid,$flagsrequired);
        }
    }
    return $flags;
}

1;




package Koha::Mojo::Plugins::Core;

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

use Mojo::Base 'Mojolicious::Plugin';

use Koha::Auth;
use Koha::Auth::Permissions;
use Koha::Template;

use Koha::Exceptions;
use Koha::Exceptions::Authorization;

=head1 NAME

Koha::Mojo::Plugins::Core - Mojolicious plugin that adds AuthZ and
    template helpers for Koha Mojolicious controllers

=head1 SYNOPSIS

=head2 METHODS

=head3 register

=cut

sub register {
    my ($self, $app, $conf) = @_;

    $app->helper(
        'koha.authenticate' => sub {
            my ($c,$args) = @_;
            my $authenticated = 0;
            my $sessionID = $c->cookie('CGISESSID');
            my ($user,$session) = Koha::Auth->authenticate({
                sessionID => $sessionID,
            });
            if ($user && $session){
                $c->stash->{__koha_user__} = $user;
                $c->stash->{__koha_session__} = $session;
                $c->cookie(
                    'CGISESSID' => $session->id,
                    {
                        httponly => 1,
                        secure => ( C4::Context->https_enabled() ? 1 : 0 ),
                        path => '/',
                    }
                );
                $authenticated = 1;
            }
            return $authenticated;
        }
    );

    $app->helper(
        'koha.authorize' => sub {
            my ($c,$args) = @_;
            my $session = $c->stash->{__koha_session__};
            my $flags = Koha::Auth->authorize({
                session => $session,
                flagsrequired => $args->{flagsrequired},
            });
            if($flags){
                $c->stash->{__koha_flags__} = $flags;
                $c->stash->{__koha_authz__} = Koha::Auth::Permissions->get_authz_from_flags({ flags => $flags });
                return ($flags,$c->stash->{__koha_user__});
            }
            else {
				Koha::Exceptions::Authorization::Unauthorized->throw(
					error => "Authorization failure. Missing required permission(s).",
					required_permissions => $args->{flagsrequired},
				);
            }
        }
    );

    $app->helper(
        'koha.template' => sub {
            my ($c,$args) = @_;
            my $template_filename = $args->{template_filename};
            my $interface = $args->{interface};
            my $template = Koha::Template::prepare_template({
                template_filename => $template_filename,
                interface => $interface,
                koha_session => $c->stash->{__koha_session__},
                koha_user => $c->stash->{__koha_user__},
                koha_authz => $c->stash->{__koha_authz__},
            });
            return $template;
        }
    );

    $app->helper(
        'koha.render_staff_error' => sub {
            my ($c,$args) = @_;
            my $status = $args->{status} // 500;
            my ($flags,$loggedinuser) = $c->koha->authorize({ flagsrequired => { catalogue => 1, } });
            my $template = $c->koha->template({
                template_filename => 'errors/errorpage.tt',
                interface => 'intranet',
            });
            $template->{VARS}->{errno} = $status;
            $template->{VARS}->{admin} = C4::Context->preference('KohaAdminEmailAddress');
            return $c->render( text => $template->output(), status => $status );
        }
    );
}

1;




package Koha::Mojo::Staff;

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Mojo::Base 'Mojolicious';

use C4::Context;
use Try::Tiny qw( catch try );

=head1 NAME

Koha::Mojo::Staff - Mojolicious application for Koha staff interface

=head1 SYNOPSIS

=head2 METHODS

=head3 startup

=cut

sub startup {
    my $self = shift;

    #NOTE: Load plugin which sets up core helper methods needed for any Koha app
    $self->plugin('Koha::Mojo::Plugins::Core');

    #NOTE: Customize application-wide exception handling
    $self->hook(around_dispatch => sub {
        my ($next,$c) = @_;
        try {
            $next->();
        }
        catch {
            my $status = 500;
            if ($_->isa('Koha::Exceptions::Authorization::Unauthorized')) {
                $status = 403;
            }
            $c->koha->render_staff_error({ status => $status });
        };
    });

    # Router
    my $r = $self->routes;

    #NOTE: The /login route is public and does not require authentication
    #FIXME: Implement a Mojolicious login route
    #$r->get('/login')->to( controller => 'login', action => 'index' );

    #NOTE: All other routes require authentication
    my $auth = $r->under('/' => sub {
        my $c = shift;
        if ( $c->koha->authenticate ){
            return 1;
        }
        else {
            #FIXME: In future, redirect to a /login route, or prompt for login here
            $c->redirect_to('/index.html');
            return;
        }
    });
    my $plugins = $auth->under('plugins');
    $plugins->any(['GET','POST'] => '/run')->to(controller => 'Plugins', action => 'run');

    #NOTE: Catch-all route to redirect to CGI 404 handler for any unmatched routes
    $auth->any('/*' => sub {
        my $c = shift;
        $c->koha->render_staff_error({ status => 404 });
    });
}

1;




package Koha::Mojo::Staff::Controller::Plugins;

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Mojo::Base 'Mojolicious::Controller';

use C4::Context;
use Koha::Plugins::Handler;

=head1 NAME

Koha::Mojo::Staff::Controller::Plugins - Mojolicious controller for running Koha plugins

=head1 SYNOPSIS

=head2 METHODS

=head3 run

=cut

sub run {
    my $c = shift;
    my $class = $c->param('class');
    my $method = $c->param('method');
    my ($flags,$loggedinuser) = $c->koha->authorize({ flagsrequired => { 'plugins' => $method } });
    my $plugins_enabled = C4::Context->config("enable_plugins");
    if ( $plugins_enabled ) {
        my $plugin = Koha::Plugins::Handler->run( { class => $class, method => $method, cgi => $c } );
    } else {
        my $template = $c->koha->template({
            template_filename => 'plugins/plugins-disabled.tt',
            interface => 'intranet',
        });
        $c->render( text => $template->output );
    }
}

1;




package Koha::Template;

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

use C4::Templates;

=head1 NAME

Koha::Template - Koha class for preparing a template for any Koha web view

=head1 SYNOPSIS

=head2 METHODS

=head3 prepare_template

=cut

sub prepare_template {
    my ($args) = @_;
    my $template;
    my $session = $args->{koha_session};
    my $user = $args->{koha_user};
    my $authz = $args->{koha_authz};
    my $template_filename = $args->{template_filename};
    my $interface = $args->{interface};
    if ($template_filename && $interface){
        $template = C4::Templates::gettemplate($template_filename,$interface);
        if ($template){
            if ($session){
                $template->{VARS}->{ sessionID } = $session->id;
            }
            if ($user){
                $template->{VARS}->{ logged_in_user } = $user;
                $template->{VARS}->{ loggedinusernumber } = $user->borrowernumber;
                $template->{VARS}->{ loggedinusername } = $user->userid;
            }
            if ($authz){
                foreach my $key ( keys %$authz ){
                    $template->{VARS}->{ $key } = $authz->{$key};
                }
            }
            #NOTE: Instead of including syspref code here like in C4::Auth, start switching to Koha.Preference in templates
        }
    }
    return $template;
}

1;

Lines 66-71 my $apiv1 = builder { Link Here

(-)a/debian/templates/plack.psgi (+32 lines)
66	$server->to_psgi_app;	66	$server->to_psgi_app;
67	};	67	};
68		68
		69	my $staff_interface = builder {
		70	my $server = Mojo::Server::PSGI->new;
		71	$server->build_app('Koha::Mojo::Staff');
		72	my $app = $server->app;
		73	$app->hook( before_dispatch => sub {
		74	my $c = shift;
		75	#NOTE: Rewrite the base path to strip off the mount prefix
		76	my $path = $c->req->url->base->path(Mojo::Path->new);
		77
		78	});
		79	$server->to_psgi_app;
		80	};
		81
69	Koha::Logger->_init;	82	Koha::Logger->_init;
70		83
71	builder {	84	builder {
Lines 114-119 builder { Link Here
114	}	127	}
115	$intranet;	128	$intranet;
116	};	129	};
		130	mount '/intranet/staff' => builder {
		131	#NOTE: it is important that these are relative links
		132	enable 'ErrorDocument',
		133	400 => 'errors/400.pl',
		134	401 => 'errors/401.pl',
		135	402 => 'errors/402.pl',
		136	403 => 'errors/403.pl',
		137	404 => 'errors/404.pl',
		138	500 => 'errors/500.pl',
		139	subrequest => 1;
		140	#NOTE: Without this middleware to catch fatal errors, ErrorDocument won't be able to render a 500 document
		141	#NOTE: This middleware must be closer to the PSGI app than ErrorDocument
		142	enable "HTTPExceptions";
		143	if ( Log::Log4perl->get_logger('plack-intranet')->has_appenders ){
		144	enable 'Log4perl', category => 'plack-intranet';
		145	enable 'LogWarn';
		146	}
		147	$staff_interface;
		148	};
117	mount '/api/v1/app.pl' => builder {	149	mount '/api/v1/app.pl' => builder {
118	if ( Log::Log4perl->get_logger('plack-api')->has_appenders ){	150	if ( Log::Log4perl->get_logger('plack-api')->has_appenders ){
119	enable 'Log4perl', category => 'plack-api';	151	enable 'Log4perl', category => 'plack-api';




#!/usr/bin/perl

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

require Mojolicious::Commands;
Mojolicious::Commands->start_app('Koha::Mojo::Staff');




#!/usr/bin/perl

use Modern::Perl;
use C4::Auth qw( get_session );
use Test::More tests => 8;
use t::lib::TestBuilder;
use t::lib::Mocks;

use Data::Dumper;
use Koha::Database;

use_ok('Koha::Auth');

t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );

my $schema = Koha::Database->new->schema;
$schema->storage->txn_begin;

subtest 'Successful authentication' => sub {
    plan tests => 2;

    $ENV{REMOTE_ADDR} = '127.0.0.1';
    my $builder = t::lib::TestBuilder->new;
    my $borrower = $builder->build({ source => 'Borrower' });
    my $session = C4::Auth::get_session;
    $session->param( 'id',           $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip', '127.0.0.1' );
    $session->flush;
    my $sessionID = $session->id;

    my ($user,$user_session) = Koha::Auth->authenticate({
        sessionID => $sessionID,
    });
    is(ref $user, 'Koha::Patron', 'User found');
    is(ref $user_session, 'CGI::Session', 'User session found');

    $session->delete;
};

subtest 'Failed authentication' => sub {
    plan tests => 2;

    $ENV{REMOTE_ADDR} = '127.0.0.1';
    my $session = C4::Auth::get_session;
    $session->flush;
    $session->param( 'ip', '127.0.0.1' );
    my $sessionID = $session->id;

    my ($user,$user_session) = Koha::Auth->authenticate({
        sessionID => $sessionID,
    });
    is($user, undef, 'User not found');
    is($user_session, undef, 'User session not found');

    $session->delete;
};

subtest 'Superlibrarian authorization' => sub {
    plan tests => 1;
    my $builder = t::lib::TestBuilder->new;
    my $borrower = $builder->build({ source => 'Borrower', value => {flags => 1,} });

    my $session = C4::Auth::get_session;
    $session->param( 'id',           $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip', '127.0.0.1' );
    $session->flush;

    my $flags = Koha::Auth->authorize({
        session => $session,
        flagsrequired => { circulate => 1 },
    });
    is($flags->{superlibrarian},1,'Got superlibrarian authorization');
};

subtest 'Circulation staff authorization' => sub {
    plan tests => 2;
    my $builder = t::lib::TestBuilder->new;
    my $borrower = $builder->build({ source => 'Borrower', value => {flags => 2,} });

    my $session = C4::Auth::get_session;
    $session->param( 'id',           $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip', '127.0.0.1' );
    $session->flush;

    my $flags = Koha::Auth->authorize({
        session => $session,
        flagsrequired => { circulate => 1 },
    });
    is($flags->{superlibrarian},0,'Did not get superlibrarian authorization');
    is($flags->{circulate},1,'Did get circulate authorization');
};

subtest 'Public user not authorized for circulate authorization requirement' => sub {
    plan tests => 1;
    my $builder = t::lib::TestBuilder->new;
    my $borrower = $builder->build({ source => 'Borrower', value => {flags => undef,} });

    my $session = C4::Auth::get_session;
    $session->param( 'id',           $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip', '127.0.0.1' );
    $session->flush;

    my $flags = Koha::Auth->authorize({
        session => $session,
        flagsrequired => { circulate => 1 },
    });
    is($flags,0,'Flags returned 0');
};

subtest 'Staff user not authorized for circulate authorization requirement' => sub {
    plan tests => 1;
    my $builder = t::lib::TestBuilder->new;
    my $borrower = $builder->build({ source => 'Borrower', value => {flags => 4,} });

    my $session = C4::Auth::get_session;
    $session->param( 'id',           $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip', '127.0.0.1' );
    $session->flush;

    my $flags = Koha::Auth->authorize({
        session => $session,
        flagsrequired => { circulate => 1 },
    });
    is($flags,0,'Flags returned 0');
};

subtest 'No authorization required' => sub {
    plan tests => 1;
    my $builder = t::lib::TestBuilder->new;
    my $borrower = $builder->build({ source => 'Borrower', value => {flags => undef,} });

    my $session = C4::Auth::get_session;
    $session->param( 'id',           $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip', '127.0.0.1' );
    $session->flush;

    my $flags = Koha::Auth->authorize({
        session => $session,
    });
    is(ref $flags,'HASH','When no flags are required, a hashref is returned');
};

$schema->storage->txn_rollback;




#!/usr/bin/perl

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

# Dummy app for testing the plugin
use Mojolicious::Lite;
use Try::Tiny;

use C4::Auth qw//;
use Koha::Patrons;
use t::lib::TestBuilder;
use t::lib::Mocks;
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );

my $schema = Koha::Database->new->schema;

app->log->level('error');

plugin 'Koha::Mojo::Plugins::Core';

get '/get_helper_details' => sub {
    my $c     = shift;
    try {
        my $authenticated = $c->koha->authenticate();
        my ($flags, $loggedinuser) = $c->koha->authorize();
        my $template = $c->koha->template({
            template_filename => 'about.tt',
            interface => 'intranet',
        });
        $c->render(
            json => {
                authenticated => $authenticated,
                flags => $flags,
                borrowernumber => $loggedinuser->borrowernumber,
                template => {
                    output => $template->output,
                    sessionID => $template->{VARS}->{sessionID},
                    loggedinusernumber => $template->{VARS}->{loggedinusernumber},
                    loggedinusername => $template->{VARS}->{loggedinusername},
                    CAN_user_circulate => $template->{VARS}->{CAN_user_circulate},
                },
            },
            status => 200,
        );
    }
    catch {
        my $status = 500;
        if ($_->isa('Koha::Exceptions::Authorization::Unauthorized')) {
            $status = 403;
        }
        $c->render( status => $status, text => '' );
    };
};

sub to_model {
    my ($args) = @_;
    return $args;
}

# The tests

use Test::More tests => 2;
use Test::Mojo;


subtest 'Test core plugins with no session' => sub {

    plan tests => 2;

    my $t = Test::Mojo->new;
    $t->get_ok('/get_helper_details')
        ->status_is(403)
};

subtest 'Test core plugins with superlibrarian' => sub {
    plan tests => 10;
    $schema->storage->txn_begin;

    my $builder = t::lib::TestBuilder->new;
    my $borrower = $builder->build({ source => 'Borrower', value => {flags => 1,} });
    my $patron = Koha::Patrons->find($borrower->{borrowernumber});
 
    my $remote_address = '127.0.0.1';
    $ENV{REMOTE_ADDR} = $remote_address;
    my $session = C4::Auth::get_session;
    $session->param( 'id',           $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip', $remote_address );
    $session->flush;

    my $t = Test::Mojo->new;
    my $tx = $t->ua->build_tx( GET => '/get_helper_details' );
    $tx->req->cookies( { name => 'CGISESSID', value => $session->id } );
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
    $t->request_ok($tx)
        ->status_is(200)
        ->json_is('/authenticated' => 1,'authenticated')
        ->json_is('/flags/superlibrarian' => 1,'superlibrarian flag set')
        ->json_is('/borrowernumber' => $patron->borrowernumber,'Borrower found')
        ->json_has('/template/output', 'template output set')
        ->json_is('/template/sessionID' => $session->id, 'sesssionID set')
        ->json_is('/template/loggedinusernumber' => $patron->borrowernumber, 'loggedinusernumber set')
        ->json_is('/template/loggedinusername' => $patron->userid, 'loggedinusername set')
        ->json_is('/template/CAN_user_circulate' => 1, 'template permissions set');

    $schema->storage->txn_rollback;
};





#!/usr/bin/perl

use Modern::Perl;
use C4::Auth qw( get_session );
use Test::More tests => 2;
use t::lib::TestBuilder;
use t::lib::Mocks;

use Koha::Database;
use Data::Dumper;
use Koha::Auth;
use Koha::Auth::Permissions;
use Koha::Patrons;
use_ok('Koha::Template');

t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );

my $schema = Koha::Database->new->schema;
$schema->storage->txn_begin;

subtest 'Prepare template' => sub {
    plan tests => 6;

    $ENV{REMOTE_ADDR} = '127.0.0.1';
    my $builder = t::lib::TestBuilder->new;
    my $borrower = $builder->build({ source => 'Borrower', value => {flags => 2,} });
    my $session = C4::Auth::get_session;
    $session->param( 'id',           $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip', '127.0.0.1' );
    $session->flush;
    my $sessionID = $session->id;
    my $flags = Koha::Auth->authorize({
        session => $session,
        flagsrequired => { circulate => 1 },
    });
    my $koha_authz = Koha::Auth::Permissions->get_authz_from_flags({ flags => $flags });
    my $koha_user = Koha::Patrons->find($borrower->{borrowernumber});

    my $htdocs = C4::Context->config('intrahtdocs');
    my $template_filename = $htdocs . '/prog/en/modules/about.tt';
    my $interface = "intranet";
    my $template = Koha::Template::prepare_template({
        template_filename => $template_filename,
        interface => $interface,
        koha_session => $session,
        koha_user => $koha_user,
        koha_authz => $koha_authz, 
    });

    ok($template->output,'Template generates output');
    is($template->{VARS}->{sessionID},$session->id,'sessionID set');
    is($template->{VARS}->{logged_in_user},$koha_user,'logged_in_user set');
    is($template->{VARS}->{loggedinusernumber},$koha_user->borrowernumber,'loggedinusernumber set');
    is($template->{VARS}->{loggedinusername},$koha_user->userid,'loggedinusername set');
    is($template->{VARS}->{CAN_user_circulate},1,'CAN_user_circulate set');

    $session->delete;
};


$schema->storage->txn_rollback;

Return to bug 31380

Line 0 Link Here

(-)a/Koha/Auth.pm (+87 lines)
		1	package Koha::Auth;
		2
		3	# This file is part of Koha.
		4	#
		5	# Koha is free software; you can redistribute it and/or modify it
		6	# under the terms of the GNU General Public License as published by
		7	# the Free Software Foundation; either version 3 of the License, or
		8	# (at your option) any later version.
		9	#
		10	# Koha is distributed in the hope that it will be useful, but
		11	# WITHOUT ANY WARRANTY; without even the implied warranty of
		12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		13	# GNU General Public License for more details.
		14	#
		15	# You should have received a copy of the GNU General Public License
		16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
		17
		18	use Modern::Perl;
		19
		20	use C4::Auth qw//;
		21	use Koha::Patrons;
		22
		23	=head1 NAME
		24
		25	Koha::Auth - Koha class for handling authentication and authorization
		26
		27	=head1 SYNOPSIS
		28
		29	=head2 METHODS
		30
		31	=head3 authenticate
		32
		33	my $user = Koha::Auth->authenticate({
		34	sessionID => $sessionID,
		35	});
		36
		37	Verifies that this user has an authenticated Koha session
		38
		39	=cut
		40
		41	sub authenticate {
		42	my ($class,$args) = @_;
		43	my ($auth_user,$auth_session);
		44	my $sessionID = $args->{sessionID};
		45	if ($sessionID){
		46	my $flags;
		47	my ( $return, $session, $more_info) = C4::Auth::check_cookie_auth($sessionID,$flags,
		48	{ remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 }
		49	);
		50	if ($return && $return eq 'ok' && $session){
		51	my $userid = $session->param('id');
		52	if ( $userid ){
		53	my $patron = Koha::Patrons->find({ userid => $userid });
		54	if ($patron){
		55	$auth_user = $patron;
		56	$auth_session = $session;
		57	}
		58	}
		59	}
		60	}
		61	return ($auth_user,$auth_session);
		62	}
		63
		64	=head3 authorize
65
66	my $flags = Koha::Auth->authorize({
67	session => $session,
68	flagsrequired => { self_check => 'self_checkout_module' },
69	});
70
71	=cut
72
73	sub authorize {
74	my ($class,$args) = @_;
75	my $flags = 0;
76	my $session = $args->{session};
77	my $flagsrequired = $args->{flagsrequired};
78	if ($session){
79	my $userid = $session->param('id');
80	if ($userid){
81	$flags = C4::Auth::haspermission($userid,$flagsrequired);
82	}
83	}
84	return $flags;
85	}
86
87	1;

Line 0 Link Here

(-)a/Koha/Mojo/Plugins/Core.pm (+124 lines)
		1	package Koha::Mojo::Plugins::Core;
		2
		3	# This file is part of Koha.
		4	#
		5	# Koha is free software; you can redistribute it and/or modify it
		6	# under the terms of the GNU General Public License as published by
		7	# the Free Software Foundation; either version 3 of the License, or
		8	# (at your option) any later version.
		9	#
		10	# Koha is distributed in the hope that it will be useful, but
		11	# WITHOUT ANY WARRANTY; without even the implied warranty of
		12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		13	# GNU General Public License for more details.
		14	#
		15	# You should have received a copy of the GNU General Public License
		16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
		17
		18	use Modern::Perl;
		19
		20	use Mojo::Base 'Mojolicious::Plugin';
		21
		22	use Koha::Auth;
		23	use Koha::Auth::Permissions;
		24	use Koha::Template;
		25
		26	use Koha::Exceptions;
		27	use Koha::Exceptions::Authorization;
		28
		29	=head1 NAME
		30
		31	Koha::Mojo::Plugins::Core - Mojolicious plugin that adds AuthZ and
		32	template helpers for Koha Mojolicious controllers
		33
		34	=head1 SYNOPSIS
		35
		36	=head2 METHODS
		37
		38	=head3 register
		39
		40	=cut
		41
		42	sub register {
		43	my ($self, $app, $conf) = @_;
		44
		45	$app->helper(
		46	'koha.authenticate' => sub {
		47	my ($c,$args) = @_;
		48	my $authenticated = 0;
		49	my $sessionID = $c->cookie('CGISESSID');
		50	my ($user,$session) = Koha::Auth->authenticate({
		51	sessionID => $sessionID,
		52	});
		53	if ($user && $session){
		54	$c->stash->{__koha_user__} = $user;
		55	$c->stash->{__koha_session__} = $session;
		56	$c->cookie(
		57	'CGISESSID' => $session->id,
		58	{
		59	httponly => 1,
		60	secure => ( C4::Context->https_enabled() ? 1 : 0 ),
		61	path => '/',
		62	}
		63	);
		64	$authenticated = 1;
65	}
66	return $authenticated;
67	}
68	);
69
70	$app->helper(
71	'koha.authorize' => sub {
72	my ($c,$args) = @_;
73	my $session = $c->stash->{__koha_session__};
74	my $flags = Koha::Auth->authorize({
75	session => $session,
76	flagsrequired => $args->{flagsrequired},
77	});
78	if($flags){
79	$c->stash->{__koha_flags__} = $flags;
80	$c->stash->{__koha_authz__} = Koha::Auth::Permissions->get_authz_from_flags({ flags => $flags });
81	return ($flags,$c->stash->{__koha_user__});
82	}
83	else {
84	Koha::Exceptions::Authorization::Unauthorized->throw(
85	error => "Authorization failure. Missing required permission(s).",
86	required_permissions => $args->{flagsrequired},
87	);
88	}
89	}
90	);
91
92	$app->helper(
93	'koha.template' => sub {
94	my ($c,$args) = @_;
95	my $template_filename = $args->{template_filename};
96	my $interface = $args->{interface};
97	my $template = Koha::Template::prepare_template({
98	template_filename => $template_filename,
99	interface => $interface,
100	koha_session => $c->stash->{__koha_session__},
101	koha_user => $c->stash->{__koha_user__},
102	koha_authz => $c->stash->{__koha_authz__},
103	});
104	return $template;
105	}
106	);
107
108	$app->helper(
109	'koha.render_staff_error' => sub {
110	my ($c,$args) = @_;
111	my $status = $args->{status} // 500;
112	my ($flags,$loggedinuser) = $c->koha->authorize({ flagsrequired => { catalogue => 1, } });
113	my $template = $c->koha->template({
114	template_filename => 'errors/errorpage.tt',
115	interface => 'intranet',
116	});
117	$template->{VARS}->{errno} = $status;
118	$template->{VARS}->{admin} = C4::Context->preference('KohaAdminEmailAddress');
119	return $c->render( text => $template->output(), status => $status );
120	}
121	);
122	}
123
124	1;

Line 0 Link Here

(-)a/Koha/Mojo/Staff.pm (+85 lines)
		1	package Koha::Mojo::Staff;
		2
		3	# This file is part of Koha.
		4	#
		5	# Koha is free software; you can redistribute it and/or modify it
		6	# under the terms of the GNU General Public License as published by
		7	# the Free Software Foundation; either version 3 of the License, or
		8	# (at your option) any later version.
		9	#
		10	# Koha is distributed in the hope that it will be useful, but
		11	# WITHOUT ANY WARRANTY; without even the implied warranty of
		12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		13	# GNU General Public License for more details.
		14	#
		15	# You should have received a copy of the GNU General Public License
		16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
		17
		18	use Mojo::Base 'Mojolicious';
		19
		20	use C4::Context;
		21	use Try::Tiny qw( catch try );
		22
		23	=head1 NAME
		24
		25	Koha::Mojo::Staff - Mojolicious application for Koha staff interface
		26
		27	=head1 SYNOPSIS
		28
		29	=head2 METHODS
		30
		31	=head3 startup
		32
		33	=cut
		34
		35	sub startup {
		36	my $self = shift;
		37
		38	#NOTE: Load plugin which sets up core helper methods needed for any Koha app
		39	$self->plugin('Koha::Mojo::Plugins::Core');
		40
		41	#NOTE: Customize application-wide exception handling
		42	$self->hook(around_dispatch => sub {
		43	my ($next,$c) = @_;
		44	try {
		45	$next->();
		46	}
		47	catch {
		48	my $status = 500;
		49	if ($_->isa('Koha::Exceptions::Authorization::Unauthorized')) {
		50	$status = 403;
		51	}
		52	$c->koha->render_staff_error({ status => $status });
		53	};
		54	});
		55
		56	# Router
		57	my $r = $self->routes;
		58
		59	#NOTE: The /login route is public and does not require authentication
		60	#FIXME: Implement a Mojolicious login route
		61	#$r->get('/login')->to( controller => 'login', action => 'index' );
		62
		63	#NOTE: All other routes require authentication
		64	my $auth = $r->under('/' => sub {
65	my $c = shift;
66	if ( $c->koha->authenticate ){
67	return 1;
68	}
69	else {
70	#FIXME: In future, redirect to a /login route, or prompt for login here
71	$c->redirect_to('/index.html');
72	return;
73	}
74	});
75	my $plugins = $auth->under('plugins');
76	$plugins->any(['GET','POST'] => '/run')->to(controller => 'Plugins', action => 'run');
77
78	#NOTE: Catch-all route to redirect to CGI 404 handler for any unmatched routes
79	$auth->any('/*' => sub {
80	my $c = shift;
81	$c->koha->render_staff_error({ status => 404 });
82	});
83	}
84
85	1;

Line 0 Link Here

(-)a/Koha/Mojo/Staff/Controller/Plugins.pm (+52 lines)
	1	package Koha::Mojo::Staff::Controller::Plugins;
	2
	3	# This file is part of Koha.
	4	#
	5	# Koha is free software; you can redistribute it and/or modify it
	6	# under the terms of the GNU General Public License as published by
	7	# the Free Software Foundation; either version 3 of the License, or
	8	# (at your option) any later version.
	9	#
	10	# Koha is distributed in the hope that it will be useful, but
	11	# WITHOUT ANY WARRANTY; without even the implied warranty of
	12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	13	# GNU General Public License for more details.
	14	#
	15	# You should have received a copy of the GNU General Public License
	16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
	17
	18	use Mojo::Base 'Mojolicious::Controller';
	19
	20	use C4::Context;
	21	use Koha::Plugins::Handler;
	22
	23	=head1 NAME
	24
	25	Koha::Mojo::Staff::Controller::Plugins - Mojolicious controller for running Koha plugins
	26
	27	=head1 SYNOPSIS
	28
	29	=head2 METHODS
	30
	31	=head3 run
	32
	33	=cut
	34
	35	sub run {
	36	my $c = shift;
	37	my $class = $c->param('class');
	38	my $method = $c->param('method');
	39	my ($flags,$loggedinuser) = $c->koha->authorize({ flagsrequired => { 'plugins' => $method } });
	40	my $plugins_enabled = C4::Context->config("enable_plugins");
	41	if ( $plugins_enabled ) {
	42	my $plugin = Koha::Plugins::Handler->run( { class => $class, method => $method, cgi => $c } );
	43	} else {
	44	my $template = $c->koha->template({
	45	template_filename => 'plugins/plugins-disabled.tt',
	46	interface => 'intranet',
	47	});
	48	$c->render( text => $template->output );
	49	}
	50	}
	51
	52	1;

Line 0 Link Here

(-)a/Koha/Template.pm (+64 lines)
	1	package Koha::Template;
	2
	3	# This file is part of Koha.
	4	#
	5	# Koha is free software; you can redistribute it and/or modify it
	6	# under the terms of the GNU General Public License as published by
	7	# the Free Software Foundation; either version 3 of the License, or
	8	# (at your option) any later version.
	9	#
	10	# Koha is distributed in the hope that it will be useful, but
	11	# WITHOUT ANY WARRANTY; without even the implied warranty of
	12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	13	# GNU General Public License for more details.
	14	#
	15	# You should have received a copy of the GNU General Public License
	16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
	17
	18	use Modern::Perl;
	19
	20	use C4::Templates;
	21
	22	=head1 NAME
	23
	24	Koha::Template - Koha class for preparing a template for any Koha web view
	25
	26	=head1 SYNOPSIS
	27
	28	=head2 METHODS
	29
	30	=head3 prepare_template
	31
	32	=cut
	33
	34	sub prepare_template {
	35	my ($args) = @_;
	36	my $template;
	37	my $session = $args->{koha_session};
	38	my $user = $args->{koha_user};
	39	my $authz = $args->{koha_authz};
	40	my $template_filename = $args->{template_filename};
	41	my $interface = $args->{interface};
	42	if ($template_filename && $interface){
	43	$template = C4::Templates::gettemplate($template_filename,$interface);
	44	if ($template){
	45	if ($session){
	46	$template->{VARS}->{ sessionID } = $session->id;
	47	}
	48	if ($user){
	49	$template->{VARS}->{ logged_in_user } = $user;
	50	$template->{VARS}->{ loggedinusernumber } = $user->borrowernumber;
	51	$template->{VARS}->{ loggedinusername } = $user->userid;
	52	}
	53	if ($authz){
	54	foreach my $key ( keys %$authz ){
	55	$template->{VARS}->{ $key } = $authz->{$key};
	56	}
	57	}
	58	#NOTE: Instead of including syspref code here like in C4::Auth, start switching to Koha.Preference in templates
	59	}
	60	}
	61	return $template;
	62	}
	63
	64	1;

Line 0 Link Here

(-)a/staff (+21 lines)
	1	#!/usr/bin/perl
	2
	3	# This file is part of Koha.
	4	#
	5	# Koha is free software; you can redistribute it and/or modify it
	6	# under the terms of the GNU General Public License as published by
	7	# the Free Software Foundation; either version 3 of the License, or
	8	# (at your option) any later version.
	9	#
	10	# Koha is distributed in the hope that it will be useful, but
	11	# WITHOUT ANY WARRANTY; without even the implied warranty of
	12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	13	# GNU General Public License for more details.
	14	#
	15	# You should have received a copy of the GNU General Public License
	16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
	17
	18	use Modern::Perl;
	19
	20	require Mojolicious::Commands;
	21	Mojolicious::Commands->start_app('Koha::Mojo::Staff');

Line 0 Link Here

(-)a/t/db_dependent/Koha/Auth.t (+149 lines)
		1	#!/usr/bin/perl
		2
		3	use Modern::Perl;
		4	use C4::Auth qw( get_session );
		5	use Test::More tests => 8;
		6	use t::lib::TestBuilder;
		7	use t::lib::Mocks;
		8
		9	use Data::Dumper;
		10	use Koha::Database;
		11
		12	use_ok('Koha::Auth');
		13
		14	t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
		15
		16	my $schema = Koha::Database->new->schema;
		17	$schema->storage->txn_begin;
		18
		19	subtest 'Successful authentication' => sub {
		20	plan tests => 2;
		21
		22	$ENV{REMOTE_ADDR} = '127.0.0.1';
		23	my $builder = t::lib::TestBuilder->new;
		24	my $borrower = $builder->build({ source => 'Borrower' });
		25	my $session = C4::Auth::get_session;
		26	$session->param( 'id', $borrower->{userid} );
		27	$session->param( 'lasttime', time() );
		28	$session->param( 'ip', '127.0.0.1' );
		29	$session->flush;
		30	my $sessionID = $session->id;
		31
		32	my ($user,$user_session) = Koha::Auth->authenticate({
		33	sessionID => $sessionID,
		34	});
		35	is(ref $user, 'Koha::Patron', 'User found');
		36	is(ref $user_session, 'CGI::Session', 'User session found');
		37
		38	$session->delete;
		39	};
		40
		41	subtest 'Failed authentication' => sub {
		42	plan tests => 2;
		43
		44	$ENV{REMOTE_ADDR} = '127.0.0.1';
		45	my $session = C4::Auth::get_session;
		46	$session->flush;
		47	$session->param( 'ip', '127.0.0.1' );
		48	my $sessionID = $session->id;
		49
		50	my ($user,$user_session) = Koha::Auth->authenticate({
		51	sessionID => $sessionID,
		52	});
		53	is($user, undef, 'User not found');
		54	is($user_session, undef, 'User session not found');
		55
		56	$session->delete;
		57	};
		58
		59	subtest 'Superlibrarian authorization' => sub {
		60	plan tests => 1;
		61	my $builder = t::lib::TestBuilder->new;
		62	my $borrower = $builder->build({ source => 'Borrower', value => {flags => 1,} });
		63
		64	my $session = C4::Auth::get_session;
65	$session->param( 'id', $borrower->{userid} );
66	$session->param( 'lasttime', time() );
67	$session->param( 'ip', '127.0.0.1' );
68	$session->flush;
69
70	my $flags = Koha::Auth->authorize({
71	session => $session,
72	flagsrequired => { circulate => 1 },
73	});
74	is($flags->{superlibrarian},1,'Got superlibrarian authorization');
75	};
76
77	subtest 'Circulation staff authorization' => sub {
78	plan tests => 2;
79	my $builder = t::lib::TestBuilder->new;
80	my $borrower = $builder->build({ source => 'Borrower', value => {flags => 2,} });
81
82	my $session = C4::Auth::get_session;
83	$session->param( 'id', $borrower->{userid} );
84	$session->param( 'lasttime', time() );
85	$session->param( 'ip', '127.0.0.1' );
86	$session->flush;
87
88	my $flags = Koha::Auth->authorize({
89	session => $session,
90	flagsrequired => { circulate => 1 },
91	});
92	is($flags->{superlibrarian},0,'Did not get superlibrarian authorization');
93	is($flags->{circulate},1,'Did get circulate authorization');
94	};
95
96	subtest 'Public user not authorized for circulate authorization requirement' => sub {
97	plan tests => 1;
98	my $builder = t::lib::TestBuilder->new;
99	my $borrower = $builder->build({ source => 'Borrower', value => {flags => undef,} });
100
101	my $session = C4::Auth::get_session;
102	$session->param( 'id', $borrower->{userid} );
103	$session->param( 'lasttime', time() );
104	$session->param( 'ip', '127.0.0.1' );
105	$session->flush;
106
107	my $flags = Koha::Auth->authorize({
108	session => $session,
109	flagsrequired => { circulate => 1 },
110	});
111	is($flags,0,'Flags returned 0');
112	};
113
114	subtest 'Staff user not authorized for circulate authorization requirement' => sub {
115	plan tests => 1;
116	my $builder = t::lib::TestBuilder->new;
117	my $borrower = $builder->build({ source => 'Borrower', value => {flags => 4,} });
118
119	my $session = C4::Auth::get_session;
120	$session->param( 'id', $borrower->{userid} );
121	$session->param( 'lasttime', time() );
122	$session->param( 'ip', '127.0.0.1' );
123	$session->flush;
124
125	my $flags = Koha::Auth->authorize({
126	session => $session,
127	flagsrequired => { circulate => 1 },
128	});
129	is($flags,0,'Flags returned 0');
130	};
131
132	subtest 'No authorization required' => sub {
133	plan tests => 1;
134	my $builder = t::lib::TestBuilder->new;
135	my $borrower = $builder->build({ source => 'Borrower', value => {flags => undef,} });
136
137	my $session = C4::Auth::get_session;
138	$session->param( 'id', $borrower->{userid} );
139	$session->param( 'lasttime', time() );
140	$session->param( 'ip', '127.0.0.1' );
141	$session->flush;
142
143	my $flags = Koha::Auth->authorize({
144	session => $session,
145	});
146	is(ref $flags,'HASH','When no flags are required, a hashref is returned');
147	};
148
149	$schema->storage->txn_rollback;

Line 0 Link Here

(-)a/t/db_dependent/Koha/Mojo/Plugins/Core.t (+123 lines)
		1	#!/usr/bin/perl
		2
		3	# This file is part of Koha.
		4	#
		5	# Koha is free software; you can redistribute it and/or modify it
		6	# under the terms of the GNU General Public License as published by
		7	# the Free Software Foundation; either version 3 of the License, or
		8	# (at your option) any later version.
		9	#
		10	# Koha is distributed in the hope that it will be useful, but
		11	# WITHOUT ANY WARRANTY; without even the implied warranty of
		12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		13	# GNU General Public License for more details.
		14	#
		15	# You should have received a copy of the GNU General Public License
		16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
		17
		18	use Modern::Perl;
		19
		20	# Dummy app for testing the plugin
		21	use Mojolicious::Lite;
		22	use Try::Tiny;
		23
		24	use C4::Auth qw//;
		25	use Koha::Patrons;
		26	use t::lib::TestBuilder;
		27	use t::lib::Mocks;
		28	t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
		29
		30	my $schema = Koha::Database->new->schema;
		31
		32	app->log->level('error');
		33
		34	plugin 'Koha::Mojo::Plugins::Core';
		35
		36	get '/get_helper_details' => sub {
		37	my $c = shift;
		38	try {
		39	my $authenticated = $c->koha->authenticate();
		40	my ($flags, $loggedinuser) = $c->koha->authorize();
		41	my $template = $c->koha->template({
		42	template_filename => 'about.tt',
		43	interface => 'intranet',
		44	});
		45	$c->render(
		46	json => {
		47	authenticated => $authenticated,
		48	flags => $flags,
		49	borrowernumber => $loggedinuser->borrowernumber,
		50	template => {
		51	output => $template->output,
		52	sessionID => $template->{VARS}->{sessionID},
		53	loggedinusernumber => $template->{VARS}->{loggedinusernumber},
		54	loggedinusername => $template->{VARS}->{loggedinusername},
		55	CAN_user_circulate => $template->{VARS}->{CAN_user_circulate},
		56	},
		57	},
		58	status => 200,
		59	);
		60	}
		61	catch {
		62	my $status = 500;
		63	if ($_->isa('Koha::Exceptions::Authorization::Unauthorized')) {
		64	$status = 403;
65	}
66	$c->render( status => $status, text => '' );
67	};
68	};
69
70	sub to_model {
71	my ($args) = @_;
72	return $args;
73	}
74
75	# The tests
76
77	use Test::More tests => 2;
78	use Test::Mojo;
79
80
81	subtest 'Test core plugins with no session' => sub {
82
83	plan tests => 2;
84
85	my $t = Test::Mojo->new;
86	$t->get_ok('/get_helper_details')
87	->status_is(403)
88	};
89
90	subtest 'Test core plugins with superlibrarian' => sub {
91	plan tests => 10;
92	$schema->storage->txn_begin;
93
94	my $builder = t::lib::TestBuilder->new;
95	my $borrower = $builder->build({ source => 'Borrower', value => {flags => 1,} });
96	my $patron = Koha::Patrons->find($borrower->{borrowernumber});
97
98	my $remote_address = '127.0.0.1';
99	$ENV{REMOTE_ADDR} = $remote_address;
100	my $session = C4::Auth::get_session;
101	$session->param( 'id', $borrower->{userid} );
102	$session->param( 'lasttime', time() );
103	$session->param( 'ip', $remote_address );
104	$session->flush;
105
106	my $t = Test::Mojo->new;
107	my $tx = $t->ua->build_tx( GET => '/get_helper_details' );
108	$tx->req->cookies( { name => 'CGISESSID', value => $session->id } );
109	$tx->req->env( { REMOTE_ADDR => $remote_address } );
110	$t->request_ok($tx)
111	->status_is(200)
112	->json_is('/authenticated' => 1,'authenticated')
113	->json_is('/flags/superlibrarian' => 1,'superlibrarian flag set')
114	->json_is('/borrowernumber' => $patron->borrowernumber,'Borrower found')
115	->json_has('/template/output', 'template output set')
116	->json_is('/template/sessionID' => $session->id, 'sesssionID set')
117	->json_is('/template/loggedinusernumber' => $patron->borrowernumber, 'loggedinusernumber set')
118	->json_is('/template/loggedinusername' => $patron->userid, 'loggedinusername set')
119	->json_is('/template/CAN_user_circulate' => 1, 'template permissions set');
120
121	$schema->storage->txn_rollback;
122	};
123

Line 0 Link Here

(-)a/t/db_dependent/Koha/Template.t (-1 / +62 lines)
0	-	1	#!/usr/bin/perl
		2
		3	use Modern::Perl;
		4	use C4::Auth qw( get_session );
		5	use Test::More tests => 2;
		6	use t::lib::TestBuilder;
		7	use t::lib::Mocks;
		8
		9	use Koha::Database;
		10	use Data::Dumper;
		11	use Koha::Auth;
		12	use Koha::Auth::Permissions;
		13	use Koha::Patrons;
		14	use_ok('Koha::Template');
		15
		16	t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
		17
		18	my $schema = Koha::Database->new->schema;
		19	$schema->storage->txn_begin;
		20
		21	subtest 'Prepare template' => sub {
		22	plan tests => 6;
		23
		24	$ENV{REMOTE_ADDR} = '127.0.0.1';
		25	my $builder = t::lib::TestBuilder->new;
		26	my $borrower = $builder->build({ source => 'Borrower', value => {flags => 2,} });
		27	my $session = C4::Auth::get_session;
		28	$session->param( 'id', $borrower->{userid} );
		29	$session->param( 'lasttime', time() );
		30	$session->param( 'ip', '127.0.0.1' );
		31	$session->flush;
		32	my $sessionID = $session->id;
		33	my $flags = Koha::Auth->authorize({
		34	session => $session,
		35	flagsrequired => { circulate => 1 },
		36	});
		37	my $koha_authz = Koha::Auth::Permissions->get_authz_from_flags({ flags => $flags });
		38	my $koha_user = Koha::Patrons->find($borrower->{borrowernumber});
		39
		40	my $htdocs = C4::Context->config('intrahtdocs');
		41	my $template_filename = $htdocs . '/prog/en/modules/about.tt';
		42	my $interface = "intranet";
		43	my $template = Koha::Template::prepare_template({
		44	template_filename => $template_filename,
		45	interface => $interface,
		46	koha_session => $session,
		47	koha_user => $koha_user,
		48	koha_authz => $koha_authz,
		49	});
		50
		51	ok($template->output,'Template generates output');
		52	is($template->{VARS}->{sessionID},$session->id,'sessionID set');
		53	is($template->{VARS}->{logged_in_user},$koha_user,'logged_in_user set');
		54	is($template->{VARS}->{loggedinusernumber},$koha_user->borrowernumber,'loggedinusernumber set');
		55	is($template->{VARS}->{loggedinusername},$koha_user->userid,'loggedinusername set');
		56	is($template->{VARS}->{CAN_user_circulate},1,'CAN_user_circulate set');
		57
		58	$session->delete;
		59	};
		60
		61
		62	$schema->storage->txn_rollback;