Attachment #158583 for bug #31380

View | Details | Raw Unified | Return to bug 31380
Collapse All | Expand All




package Koha::Auth;

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

use C4::Auth qw//;
use Koha::Patrons;

=head1 NAME

Koha::Auth - Koha class for handling authentication and authorization

=head1 SYNOPSIS

=head2 METHODS

=head3 authenticate

    my $user = Koha::Auth->authenticate({
        sessionID => $sessionID,
    });

Verifies that this user has an authenticated Koha session

=cut

sub authenticate {
    my ( $class, $args ) = @_;
    my ( $auth_user, $auth_session );
    my $sessionID = $args->{sessionID};
    if ($sessionID) {
        my $flags;
        my ( $return, $session, $more_info ) = C4::Auth::check_cookie_auth(
            $sessionID, $flags,
            { remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 }
        );
        if ( $return && $return eq 'ok' && $session ) {
            my $userid = $session->param('id');
            if ($userid) {
                my $patron = Koha::Patrons->find( { userid => $userid } );
                if ($patron) {
                    $auth_user    = $patron;
                    $auth_session = $session;
                }
            }
        }
    }
    return ( $auth_user, $auth_session );
}

=head3 authorize

    my $flags = Koha::Auth->authorize({
        session => $session,
        flagsrequired => { self_check => 'self_checkout_module' },
    });

=cut

sub authorize {
    my ( $class, $args ) = @_;
    my $flags         = 0;
    my $session       = $args->{session};
    my $flagsrequired = $args->{flagsrequired};
    if ($session) {
        my $userid = $session->param('id');
        if ($userid) {
            $flags = C4::Auth::haspermission( $userid, $flagsrequired );
        }
    }
    return $flags;
}

1;




package Koha::Mojo::Plugins::Core;

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

use Mojo::Base 'Mojolicious::Plugin';

use Koha::Auth;
use Koha::Auth::Permissions;
use Koha::Template;

use Koha::Exceptions;
use Koha::Exceptions::Authorization;

=head1 NAME

Koha::Mojo::Plugins::Core - Mojolicious plugin that adds AuthZ and
    template helpers for Koha Mojolicious controllers

=head1 SYNOPSIS

=head2 METHODS

=head3 register

=cut

sub register {
    my ( $self, $app, $conf ) = @_;

    $app->helper(
        'koha.authenticate' => sub {
            my ( $c, $args ) = @_;
            my $authenticated = 0;
            my $sessionID     = $c->cookie('CGISESSID');
            my ( $user, $session ) = Koha::Auth->authenticate(
                {
                    sessionID => $sessionID,
                }
            );
            if ( $user && $session ) {
                $c->stash->{__koha_user__}    = $user;
                $c->stash->{__koha_session__} = $session;
                $c->cookie(
                    'CGISESSID' => $session->id,
                    {
                        httponly => 1,
                        secure   => ( C4::Context->https_enabled() ? 1 : 0 ),
                        path     => '/',
                    }
                );
                $authenticated = 1;
            }
            return $authenticated;
        }
    );

    $app->helper(
        'koha.authorize' => sub {
            my ( $c, $args ) = @_;
            my $session = $c->stash->{__koha_session__};
            my $flags   = Koha::Auth->authorize(
                {
                    session       => $session,
                    flagsrequired => $args->{flagsrequired},
                }
            );
            if ($flags) {
                $c->stash->{__koha_flags__} = $flags;
                $c->stash->{__koha_authz__} = Koha::Auth::Permissions->get_authz_from_flags( { flags => $flags } );
                return ( $flags, $c->stash->{__koha_user__} );
            } else {
                Koha::Exceptions::Authorization::Unauthorized->throw(
                    error                => "Authorization failure. Missing required permission(s).",
                    required_permissions => $args->{flagsrequired},
                );
            }
        }
    );

    $app->helper(
        'koha.template' => sub {
            my ( $c, $args ) = @_;
            my $template_filename = $args->{template_filename};
            my $interface         = $args->{interface};
            my $template          = Koha::Template::prepare_template(
                {
                    template_filename => $template_filename,
                    interface         => $interface,
                    koha_session      => $c->stash->{__koha_session__},
                    koha_user         => $c->stash->{__koha_user__},
                    koha_authz        => $c->stash->{__koha_authz__},
                }
            );
            return $template;
        }
    );

    $app->helper(
        'koha.render_staff_error' => sub {
            my ( $c, $args ) = @_;
            my $status = $args->{status} // 500;
            my ( $flags, $loggedinuser ) = $c->koha->authorize( { flagsrequired => { catalogue => 1, } } );
            my $template = $c->koha->template(
                {
                    template_filename => 'errors/errorpage.tt',
                    interface         => 'intranet',
                }
            );
            $template->{VARS}->{errno} = $status;
            $template->{VARS}->{admin} = C4::Context->preference('KohaAdminEmailAddress');
            return $c->render( text => $template->output(), status => $status );
        }
    );
}

1;




package Koha::Mojo::Staff;

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Mojo::Base 'Mojolicious';

use C4::Context;
use Try::Tiny qw( catch try );

=head1 NAME

Koha::Mojo::Staff - Mojolicious application for Koha staff interface

=head1 SYNOPSIS

=head2 METHODS

=head3 startup

=cut

sub startup {
    my $self = shift;

    #NOTE: Load plugin which sets up core helper methods needed for any Koha app
    $self->plugin('Koha::Mojo::Plugins::Core');

    #NOTE: Customize application-wide exception handling
    $self->hook(
        around_dispatch => sub {
            my ( $next, $c ) = @_;
            try {
                $next->();
            } catch {
                my $status = 500;
                if ( $_->isa('Koha::Exceptions::Authorization::Unauthorized') ) {
                    $status = 403;
                }
                $c->koha->render_staff_error( { status => $status } );
            };
        }
    );

    # Router
    my $r = $self->routes;

    #NOTE: The /login route is public and does not require authentication
    #FIXME: Implement a Mojolicious login route
    #$r->get('/login')->to( controller => 'login', action => 'index' );

    #NOTE: All other routes require authentication
    my $auth = $r->under(
        '/' => sub {
            my $c = shift;
            if ( $c->koha->authenticate ) {
                return 1;
            } else {

                #FIXME: In future, redirect to a /login route, or prompt for login here
                $c->redirect_to('/index.html');
                return;
            }
        }
    );
    my $plugins = $auth->under('plugins');
    $plugins->any( [ 'GET', 'POST' ] => '/run' )->to( controller => 'Plugins', action => 'run' );

    #NOTE: Catch-all route to redirect to CGI 404 handler for any unmatched routes
    $auth->any(
        '/*' => sub {
            my $c = shift;
            $c->koha->render_staff_error( { status => 404 } );
        }
    );
}

1;




package Koha::Mojo::Staff::Controller::Plugins;

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Mojo::Base 'Mojolicious::Controller';

use C4::Context;
use Koha::Plugins::Handler;

=head1 NAME

Koha::Mojo::Staff::Controller::Plugins - Mojolicious controller for running Koha plugins

=head1 SYNOPSIS

=head2 METHODS

=head3 run

=cut

sub run {
    my $c      = shift;
    my $class  = $c->param('class');
    my $method = $c->param('method');
    my ( $flags, $loggedinuser ) = $c->koha->authorize( { flagsrequired => { 'plugins' => $method } } );
    my $plugins_enabled = C4::Context->config("enable_plugins");
    if ($plugins_enabled) {
        my $plugin = Koha::Plugins::Handler->run( { class => $class, method => $method, cgi => $c } );
    } else {
        my $template = $c->koha->template(
            {
                template_filename => 'plugins/plugins-disabled.tt',
                interface         => 'intranet',
            }
        );
        $c->render( text => $template->output );
    }
}

1;




package Koha::Template;

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

use C4::Templates;

=head1 NAME

Koha::Template - Koha class for preparing a template for any Koha web view

=head1 SYNOPSIS

=head2 METHODS

=head3 prepare_template

=cut

sub prepare_template {
    my ($args) = @_;
    my $template;
    my $session           = $args->{koha_session};
    my $user              = $args->{koha_user};
    my $authz             = $args->{koha_authz};
    my $template_filename = $args->{template_filename};
    my $interface         = $args->{interface};
    if ( $template_filename && $interface ) {
        $template = C4::Templates::gettemplate( $template_filename, $interface );
        if ($template) {
            if ($session) {
                $template->{VARS}->{sessionID} = $session->id;
            }
            if ($user) {
                $template->{VARS}->{logged_in_user}     = $user;
                $template->{VARS}->{loggedinusernumber} = $user->borrowernumber;
                $template->{VARS}->{loggedinusername}   = $user->userid;
            }
            if ($authz) {
                foreach my $key ( keys %$authz ) {
                    $template->{VARS}->{$key} = $authz->{$key};
                }
            }

            #NOTE: Instead of including syspref code here like in C4::Auth, start switching to Koha.Preference in templates
        }
    }
    return $template;
}

1;

Lines 66-71 my $apiv1 = builder { Link Here

(-)a/debian/templates/plack.psgi (+32 lines)
66	$server->to_psgi_app;	66	$server->to_psgi_app;
67	};	67	};
68		68
		69	my $staff_interface = builder {
		70	my $server = Mojo::Server::PSGI->new;
		71	$server->build_app('Koha::Mojo::Staff');
		72	my $app = $server->app;
		73	$app->hook( before_dispatch => sub {
		74	my $c = shift;
		75	#NOTE: Rewrite the base path to strip off the mount prefix
		76	my $path = $c->req->url->base->path(Mojo::Path->new);
		77
		78	});
		79	$server->to_psgi_app;
		80	};
		81
69	Koha::Logger->_init;	82	Koha::Logger->_init;
70		83
71	builder {	84	builder {
Lines 114-119 builder { Link Here
114	}	127	}
115	$intranet;	128	$intranet;
116	};	129	};
		130	mount '/intranet/staff' => builder {
		131	#NOTE: it is important that these are relative links
		132	enable 'ErrorDocument',
		133	400 => 'errors/400.pl',
		134	401 => 'errors/401.pl',
		135	402 => 'errors/402.pl',
		136	403 => 'errors/403.pl',
		137	404 => 'errors/404.pl',
		138	500 => 'errors/500.pl',
		139	subrequest => 1;
		140	#NOTE: Without this middleware to catch fatal errors, ErrorDocument won't be able to render a 500 document
		141	#NOTE: This middleware must be closer to the PSGI app than ErrorDocument
		142	enable "HTTPExceptions";
		143	if ( Log::Log4perl->get_logger('plack-intranet')->has_appenders ){
		144	enable 'Log4perl', category => 'plack-intranet';
		145	enable 'LogWarn';
		146	}
		147	$staff_interface;
		148	};
117	mount '/api/v1/app.pl' => builder {	149	mount '/api/v1/app.pl' => builder {
118	if ( Log::Log4perl->get_logger('plack-api')->has_appenders ){	150	if ( Log::Log4perl->get_logger('plack-api')->has_appenders ){
119	enable 'Log4perl', category => 'plack-api';	151	enable 'Log4perl', category => 'plack-api';




#!/usr/bin/perl

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

require Mojolicious::Commands;
Mojolicious::Commands->start_app('Koha::Mojo::Staff');




#!/usr/bin/perl

use Modern::Perl;
use C4::Auth qw( get_session );
use Test::More tests => 8;
use t::lib::TestBuilder;
use t::lib::Mocks;

use Data::Dumper;
use Koha::Database;

use_ok('Koha::Auth');

t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );

my $schema = Koha::Database->new->schema;
$schema->storage->txn_begin;

subtest 'Successful authentication' => sub {
    plan tests => 2;

    $ENV{REMOTE_ADDR} = '127.0.0.1';
    my $builder  = t::lib::TestBuilder->new;
    my $borrower = $builder->build( { source => 'Borrower' } );
    my $session  = C4::Auth::get_session;
    $session->param( 'id',       $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip',       '127.0.0.1' );
    $session->flush;
    my $sessionID = $session->id;

    my ( $user, $user_session ) = Koha::Auth->authenticate(
        {
            sessionID => $sessionID,
        }
    );
    is( ref $user,         'Koha::Patron', 'User found' );
    is( ref $user_session, 'CGI::Session', 'User session found' );

    $session->delete;
};

subtest 'Failed authentication' => sub {
    plan tests => 2;

    $ENV{REMOTE_ADDR} = '127.0.0.1';
    my $session = C4::Auth::get_session;
    $session->flush;
    $session->param( 'ip', '127.0.0.1' );
    my $sessionID = $session->id;

    my ( $user, $user_session ) = Koha::Auth->authenticate(
        {
            sessionID => $sessionID,
        }
    );
    is( $user,         undef, 'User not found' );
    is( $user_session, undef, 'User session not found' );

    $session->delete;
};

subtest 'Superlibrarian authorization' => sub {
    plan tests => 1;
    my $builder  = t::lib::TestBuilder->new;
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => 1, } } );

    my $session = C4::Auth::get_session;
    $session->param( 'id',       $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip',       '127.0.0.1' );
    $session->flush;

    my $flags = Koha::Auth->authorize(
        {
            session       => $session,
            flagsrequired => { circulate => 1 },
        }
    );
    is( $flags->{superlibrarian}, 1, 'Got superlibrarian authorization' );
};

subtest 'Circulation staff authorization' => sub {
    plan tests => 2;
    my $builder  = t::lib::TestBuilder->new;
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => 2, } } );

    my $session = C4::Auth::get_session;
    $session->param( 'id',       $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip',       '127.0.0.1' );
    $session->flush;

    my $flags = Koha::Auth->authorize(
        {
            session       => $session,
            flagsrequired => { circulate => 1 },
        }
    );
    is( $flags->{superlibrarian}, 0, 'Did not get superlibrarian authorization' );
    is( $flags->{circulate},      1, 'Did get circulate authorization' );
};

subtest 'Public user not authorized for circulate authorization requirement' => sub {
    plan tests => 1;
    my $builder  = t::lib::TestBuilder->new;
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => undef, } } );

    my $session = C4::Auth::get_session;
    $session->param( 'id',       $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip',       '127.0.0.1' );
    $session->flush;

    my $flags = Koha::Auth->authorize(
        {
            session       => $session,
            flagsrequired => { circulate => 1 },
        }
    );
    is( $flags, 0, 'Flags returned 0' );
};

subtest 'Staff user not authorized for circulate authorization requirement' => sub {
    plan tests => 1;
    my $builder  = t::lib::TestBuilder->new;
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => 4, } } );

    my $session = C4::Auth::get_session;
    $session->param( 'id',       $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip',       '127.0.0.1' );
    $session->flush;

    my $flags = Koha::Auth->authorize(
        {
            session       => $session,
            flagsrequired => { circulate => 1 },
        }
    );
    is( $flags, 0, 'Flags returned 0' );
};

subtest 'No authorization required' => sub {
    plan tests => 1;
    my $builder  = t::lib::TestBuilder->new;
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => undef, } } );

    my $session = C4::Auth::get_session;
    $session->param( 'id',       $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip',       '127.0.0.1' );
    $session->flush;

    my $flags = Koha::Auth->authorize(
        {
            session => $session,
        }
    );
    is( ref $flags, 'HASH', 'When no flags are required, a hashref is returned' );
};

$schema->storage->txn_rollback;




#!/usr/bin/perl

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

# Dummy app for testing the plugin
use Mojolicious::Lite;
use Try::Tiny;

use C4::Auth qw//;
use Koha::Patrons;
use t::lib::TestBuilder;
use t::lib::Mocks;
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );

my $schema = Koha::Database->new->schema;

app->log->level('error');

plugin 'Koha::Mojo::Plugins::Core';

get '/get_helper_details' => sub {
    my $c = shift;
    try {
        my $authenticated = $c->koha->authenticate();
        my ( $flags, $loggedinuser ) = $c->koha->authorize();
        my $template = $c->koha->template(
            {
                template_filename => 'about.tt',
                interface         => 'intranet',
            }
        );
        $c->render(
            json => {
                authenticated  => $authenticated,
                flags          => $flags,
                borrowernumber => $loggedinuser->borrowernumber,
                template       => {
                    output             => $template->output,
                    sessionID          => $template->{VARS}->{sessionID},
                    loggedinusernumber => $template->{VARS}->{loggedinusernumber},
                    loggedinusername   => $template->{VARS}->{loggedinusername},
                    CAN_user_circulate => $template->{VARS}->{CAN_user_circulate},
                },
            },
            status => 200,
        );
    } catch {
        my $status = 500;
        if ( $_->isa('Koha::Exceptions::Authorization::Unauthorized') ) {
            $status = 403;
        }
        $c->render( status => $status, text => '' );
    };
};

sub to_model {
    my ($args) = @_;
    return $args;
}

# The tests

use Test::More tests => 2;
use Test::Mojo;

subtest 'Test core plugins with no session' => sub {

    plan tests => 2;

    my $t = Test::Mojo->new;
    $t->get_ok('/get_helper_details')->status_is(403);
};

subtest 'Test core plugins with superlibrarian' => sub {
    plan tests => 10;
    $schema->storage->txn_begin;

    my $builder  = t::lib::TestBuilder->new;
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => 1, } } );
    my $patron   = Koha::Patrons->find( $borrower->{borrowernumber} );

    my $remote_address = '127.0.0.1';
    $ENV{REMOTE_ADDR} = $remote_address;
    my $session = C4::Auth::get_session;
    $session->param( 'id',       $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip',       $remote_address );
    $session->flush;

    my $t  = Test::Mojo->new;
    my $tx = $t->ua->build_tx( GET => '/get_helper_details' );
    $tx->req->cookies( { name => 'CGISESSID', value => $session->id } );
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
    $t->request_ok($tx)->status_is(200)->json_is( '/authenticated' => 1, 'authenticated' )
        ->json_is( '/flags/superlibrarian' => 1,                       'superlibrarian flag set' )
        ->json_is( '/borrowernumber'       => $patron->borrowernumber, 'Borrower found' )
        ->json_has( '/template/output', 'template output set' )
        ->json_is( '/template/sessionID'          => $session->id,            'sesssionID set' )
        ->json_is( '/template/loggedinusernumber' => $patron->borrowernumber, 'loggedinusernumber set' )
        ->json_is( '/template/loggedinusername'   => $patron->userid,         'loggedinusername set' )
        ->json_is( '/template/CAN_user_circulate' => 1,                       'template permissions set' );

    $schema->storage->txn_rollback;
};




#!/usr/bin/perl

use Modern::Perl;
use C4::Auth qw( get_session );
use Test::More tests => 2;
use t::lib::TestBuilder;
use t::lib::Mocks;

use Koha::Database;
use Data::Dumper;
use Koha::Auth;
use Koha::Auth::Permissions;
use Koha::Patrons;
use_ok('Koha::Template');

t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );

my $schema = Koha::Database->new->schema;
$schema->storage->txn_begin;

subtest 'Prepare template' => sub {
    plan tests => 6;

    $ENV{REMOTE_ADDR} = '127.0.0.1';
    my $builder  = t::lib::TestBuilder->new;
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => 2, } } );
    my $session  = C4::Auth::get_session;
    $session->param( 'id',       $borrower->{userid} );
    $session->param( 'lasttime', time() );
    $session->param( 'ip',       '127.0.0.1' );
    $session->flush;
    my $sessionID = $session->id;
    my $flags     = Koha::Auth->authorize(
        {
            session       => $session,
            flagsrequired => { circulate => 1 },
        }
    );
    my $koha_authz = Koha::Auth::Permissions->get_authz_from_flags( { flags => $flags } );
    my $koha_user  = Koha::Patrons->find( $borrower->{borrowernumber} );

    my $htdocs            = C4::Context->config('intrahtdocs');
    my $template_filename = $htdocs . '/prog/en/modules/about.tt';
    my $interface         = "intranet";
    my $template          = Koha::Template::prepare_template(
        {
            template_filename => $template_filename,
            interface         => $interface,
            koha_session      => $session,
            koha_user         => $koha_user,
            koha_authz        => $koha_authz,
        }
    );

    ok( $template->output, 'Template generates output' );
    is( $template->{VARS}->{sessionID},          $session->id,               'sessionID set' );
    is( $template->{VARS}->{logged_in_user},     $koha_user,                 'logged_in_user set' );
    is( $template->{VARS}->{loggedinusernumber}, $koha_user->borrowernumber, 'loggedinusernumber set' );
    is( $template->{VARS}->{loggedinusername},   $koha_user->userid,         'loggedinusername set' );
    is( $template->{VARS}->{CAN_user_circulate}, 1,                          'CAN_user_circulate set' );

    $session->delete;
};

$schema->storage->txn_rollback;

Return to bug 31380

Line 0 Link Here

(-)a/Koha/Auth.pm (+88 lines)
		1	package Koha::Auth;
		2
		3	# This file is part of Koha.
		4	#
		5	# Koha is free software; you can redistribute it and/or modify it
		6	# under the terms of the GNU General Public License as published by
		7	# the Free Software Foundation; either version 3 of the License, or
		8	# (at your option) any later version.
		9	#
		10	# Koha is distributed in the hope that it will be useful, but
		11	# WITHOUT ANY WARRANTY; without even the implied warranty of
		12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		13	# GNU General Public License for more details.
		14	#
		15	# You should have received a copy of the GNU General Public License
		16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
		17
		18	use Modern::Perl;
		19
		20	use C4::Auth qw//;
		21	use Koha::Patrons;
		22
		23	=head1 NAME
		24
		25	Koha::Auth - Koha class for handling authentication and authorization
		26
		27	=head1 SYNOPSIS
		28
		29	=head2 METHODS
		30
		31	=head3 authenticate
		32
		33	my $user = Koha::Auth->authenticate({
		34	sessionID => $sessionID,
		35	});
		36
		37	Verifies that this user has an authenticated Koha session
		38
		39	=cut
		40
		41	sub authenticate {
		42	my ( $class, $args ) = @_;
		43	my ( $auth_user, $auth_session );
		44	my $sessionID = $args->{sessionID};
		45	if ($sessionID) {
		46	my $flags;
		47	my ( $return, $session, $more_info ) = C4::Auth::check_cookie_auth(
		48	$sessionID, $flags,
		49	{ remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 }
		50	);
		51	if ( $return && $return eq 'ok' && $session ) {
		52	my $userid = $session->param('id');
		53	if ($userid) {
		54	my $patron = Koha::Patrons->find( { userid => $userid } );
		55	if ($patron) {
		56	$auth_user = $patron;
		57	$auth_session = $session;
		58	}
		59	}
		60	}
		61	}
		62	return ( $auth_user, $auth_session );
		63	}
		64
65	=head3 authorize
66
67	my $flags = Koha::Auth->authorize({
68	session => $session,
69	flagsrequired => { self_check => 'self_checkout_module' },
70	});
71
72	=cut
73
74	sub authorize {
75	my ( $class, $args ) = @_;
76	my $flags = 0;
77	my $session = $args->{session};
78	my $flagsrequired = $args->{flagsrequired};
79	if ($session) {
80	my $userid = $session->param('id');
81	if ($userid) {
82	$flags = C4::Auth::haspermission( $userid, $flagsrequired );
83	}
84	}
85	return $flags;
86	}
87
88	1;

Line 0 Link Here

(-)a/Koha/Mojo/Plugins/Core.pm (+131 lines)
		1	package Koha::Mojo::Plugins::Core;
		2
		3	# This file is part of Koha.
		4	#
		5	# Koha is free software; you can redistribute it and/or modify it
		6	# under the terms of the GNU General Public License as published by
		7	# the Free Software Foundation; either version 3 of the License, or
		8	# (at your option) any later version.
		9	#
		10	# Koha is distributed in the hope that it will be useful, but
		11	# WITHOUT ANY WARRANTY; without even the implied warranty of
		12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		13	# GNU General Public License for more details.
		14	#
		15	# You should have received a copy of the GNU General Public License
		16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
		17
		18	use Modern::Perl;
		19
		20	use Mojo::Base 'Mojolicious::Plugin';
		21
		22	use Koha::Auth;
		23	use Koha::Auth::Permissions;
		24	use Koha::Template;
		25
		26	use Koha::Exceptions;
		27	use Koha::Exceptions::Authorization;
		28
		29	=head1 NAME
		30
		31	Koha::Mojo::Plugins::Core - Mojolicious plugin that adds AuthZ and
		32	template helpers for Koha Mojolicious controllers
		33
		34	=head1 SYNOPSIS
		35
		36	=head2 METHODS
		37
		38	=head3 register
		39
		40	=cut
		41
		42	sub register {
		43	my ( $self, $app, $conf ) = @_;
		44
		45	$app->helper(
		46	'koha.authenticate' => sub {
		47	my ( $c, $args ) = @_;
		48	my $authenticated = 0;
		49	my $sessionID = $c->cookie('CGISESSID');
		50	my ( $user, $session ) = Koha::Auth->authenticate(
		51	{
		52	sessionID => $sessionID,
		53	}
		54	);
		55	if ( $user && $session ) {
		56	$c->stash->{__koha_user__} = $user;
		57	$c->stash->{__koha_session__} = $session;
		58	$c->cookie(
		59	'CGISESSID' => $session->id,
		60	{
		61	httponly => 1,
		62	secure => ( C4::Context->https_enabled() ? 1 : 0 ),
		63	path => '/',
		64	}
65	);
66	$authenticated = 1;
67	}
68	return $authenticated;
69	}
70	);
71
72	$app->helper(
73	'koha.authorize' => sub {
74	my ( $c, $args ) = @_;
75	my $session = $c->stash->{__koha_session__};
76	my $flags = Koha::Auth->authorize(
77	{
78	session => $session,
79	flagsrequired => $args->{flagsrequired},
80	}
81	);
82	if ($flags) {
83	$c->stash->{__koha_flags__} = $flags;
84	$c->stash->{__koha_authz__} = Koha::Auth::Permissions->get_authz_from_flags( { flags => $flags } );
85	return ( $flags, $c->stash->{__koha_user__} );
86	} else {
87	Koha::Exceptions::Authorization::Unauthorized->throw(
88	error => "Authorization failure. Missing required permission(s).",
89	required_permissions => $args->{flagsrequired},
90	);
91	}
92	}
93	);
94
95	$app->helper(
96	'koha.template' => sub {
97	my ( $c, $args ) = @_;
98	my $template_filename = $args->{template_filename};
99	my $interface = $args->{interface};
100	my $template = Koha::Template::prepare_template(
101	{
102	template_filename => $template_filename,
103	interface => $interface,
104	koha_session => $c->stash->{__koha_session__},
105	koha_user => $c->stash->{__koha_user__},
106	koha_authz => $c->stash->{__koha_authz__},
107	}
108	);
109	return $template;
110	}
111	);
112
113	$app->helper(
114	'koha.render_staff_error' => sub {
115	my ( $c, $args ) = @_;
116	my $status = $args->{status} // 500;
117	my ( $flags, $loggedinuser ) = $c->koha->authorize( { flagsrequired => { catalogue => 1, } } );
118	my $template = $c->koha->template(
119	{
120	template_filename => 'errors/errorpage.tt',
121	interface => 'intranet',
122	}
123	);
124	$template->{VARS}->{errno} = $status;
125	$template->{VARS}->{admin} = C4::Context->preference('KohaAdminEmailAddress');
126	return $c->render( text => $template->output(), status => $status );
127	}
128	);
129	}
130
131	1;

Line 0 Link Here

(-)a/Koha/Mojo/Staff.pm (+90 lines)
		1	package Koha::Mojo::Staff;
		2
		3	# This file is part of Koha.
		4	#
		5	# Koha is free software; you can redistribute it and/or modify it
		6	# under the terms of the GNU General Public License as published by
		7	# the Free Software Foundation; either version 3 of the License, or
		8	# (at your option) any later version.
		9	#
		10	# Koha is distributed in the hope that it will be useful, but
		11	# WITHOUT ANY WARRANTY; without even the implied warranty of
		12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		13	# GNU General Public License for more details.
		14	#
		15	# You should have received a copy of the GNU General Public License
		16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
		17
		18	use Mojo::Base 'Mojolicious';
		19
		20	use C4::Context;
		21	use Try::Tiny qw( catch try );
		22
		23	=head1 NAME
		24
		25	Koha::Mojo::Staff - Mojolicious application for Koha staff interface
		26
		27	=head1 SYNOPSIS
		28
		29	=head2 METHODS
		30
		31	=head3 startup
		32
		33	=cut
		34
		35	sub startup {
		36	my $self = shift;
		37
		38	#NOTE: Load plugin which sets up core helper methods needed for any Koha app
		39	$self->plugin('Koha::Mojo::Plugins::Core');
		40
		41	#NOTE: Customize application-wide exception handling
		42	$self->hook(
		43	around_dispatch => sub {
		44	my ( $next, $c ) = @_;
		45	try {
		46	$next->();
		47	} catch {
		48	my $status = 500;
		49	if ( $_->isa('Koha::Exceptions::Authorization::Unauthorized') ) {
		50	$status = 403;
		51	}
		52	$c->koha->render_staff_error( { status => $status } );
		53	};
		54	}
		55	);
		56
		57	# Router
		58	my $r = $self->routes;
		59
		60	#NOTE: The /login route is public and does not require authentication
		61	#FIXME: Implement a Mojolicious login route
		62	#$r->get('/login')->to( controller => 'login', action => 'index' );
		63
		64	#NOTE: All other routes require authentication
65	my $auth = $r->under(
66	'/' => sub {
67	my $c = shift;
68	if ( $c->koha->authenticate ) {
69	return 1;
70	} else {
71
72	#FIXME: In future, redirect to a /login route, or prompt for login here
73	$c->redirect_to('/index.html');
74	return;
75	}
76	}
77	);
78	my $plugins = $auth->under('plugins');
79	$plugins->any( [ 'GET', 'POST' ] => '/run' )->to( controller => 'Plugins', action => 'run' );
80
81	#NOTE: Catch-all route to redirect to CGI 404 handler for any unmatched routes
82	$auth->any(
83	'/*' => sub {
84	my $c = shift;
85	$c->koha->render_staff_error( { status => 404 } );
86	}
87	);
88	}
89
90	1;

Line 0 Link Here

(-)a/Koha/Mojo/Staff/Controller/Plugins.pm (+54 lines)
	1	package Koha::Mojo::Staff::Controller::Plugins;
	2
	3	# This file is part of Koha.
	4	#
	5	# Koha is free software; you can redistribute it and/or modify it
	6	# under the terms of the GNU General Public License as published by
	7	# the Free Software Foundation; either version 3 of the License, or
	8	# (at your option) any later version.
	9	#
	10	# Koha is distributed in the hope that it will be useful, but
	11	# WITHOUT ANY WARRANTY; without even the implied warranty of
	12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	13	# GNU General Public License for more details.
	14	#
	15	# You should have received a copy of the GNU General Public License
	16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
	17
	18	use Mojo::Base 'Mojolicious::Controller';
	19
	20	use C4::Context;
	21	use Koha::Plugins::Handler;
	22
	23	=head1 NAME
	24
	25	Koha::Mojo::Staff::Controller::Plugins - Mojolicious controller for running Koha plugins
	26
	27	=head1 SYNOPSIS
	28
	29	=head2 METHODS
	30
	31	=head3 run
	32
	33	=cut
	34
	35	sub run {
	36	my $c = shift;
	37	my $class = $c->param('class');
	38	my $method = $c->param('method');
	39	my ( $flags, $loggedinuser ) = $c->koha->authorize( { flagsrequired => { 'plugins' => $method } } );
	40	my $plugins_enabled = C4::Context->config("enable_plugins");
	41	if ($plugins_enabled) {
	42	my $plugin = Koha::Plugins::Handler->run( { class => $class, method => $method, cgi => $c } );
	43	} else {
	44	my $template = $c->koha->template(
	45	{
	46	template_filename => 'plugins/plugins-disabled.tt',
	47	interface => 'intranet',
	48	}
	49	);
	50	$c->render( text => $template->output );
	51	}
	52	}
	53
	54	1;

Line 0 Link Here

(-)a/Koha/Template.pm (+65 lines)
		1	package Koha::Template;
		2
		3	# This file is part of Koha.
		4	#
		5	# Koha is free software; you can redistribute it and/or modify it
		6	# under the terms of the GNU General Public License as published by
		7	# the Free Software Foundation; either version 3 of the License, or
		8	# (at your option) any later version.
		9	#
		10	# Koha is distributed in the hope that it will be useful, but
		11	# WITHOUT ANY WARRANTY; without even the implied warranty of
		12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		13	# GNU General Public License for more details.
		14	#
		15	# You should have received a copy of the GNU General Public License
		16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
		17
		18	use Modern::Perl;
		19
		20	use C4::Templates;
		21
		22	=head1 NAME
		23
		24	Koha::Template - Koha class for preparing a template for any Koha web view
		25
		26	=head1 SYNOPSIS
		27
		28	=head2 METHODS
		29
		30	=head3 prepare_template
		31
		32	=cut
		33
		34	sub prepare_template {
		35	my ($args) = @_;
		36	my $template;
		37	my $session = $args->{koha_session};
		38	my $user = $args->{koha_user};
		39	my $authz = $args->{koha_authz};
		40	my $template_filename = $args->{template_filename};
		41	my $interface = $args->{interface};
		42	if ( $template_filename && $interface ) {
		43	$template = C4::Templates::gettemplate( $template_filename, $interface );
		44	if ($template) {
		45	if ($session) {
		46	$template->{VARS}->{sessionID} = $session->id;
		47	}
		48	if ($user) {
		49	$template->{VARS}->{logged_in_user} = $user;
		50	$template->{VARS}->{loggedinusernumber} = $user->borrowernumber;
		51	$template->{VARS}->{loggedinusername} = $user->userid;
		52	}
		53	if ($authz) {
		54	foreach my $key ( keys %$authz ) {
		55	$template->{VARS}->{$key} = $authz->{$key};
		56	}
		57	}
		58
		59	#NOTE: Instead of including syspref code here like in C4::Auth, start switching to Koha.Preference in templates
		60	}
		61	}
		62	return $template;
		63	}
		64
65	1;

Line 0 Link Here

(-)a/staff (+21 lines)
	1	#!/usr/bin/perl
	2
	3	# This file is part of Koha.
	4	#
	5	# Koha is free software; you can redistribute it and/or modify it
	6	# under the terms of the GNU General Public License as published by
	7	# the Free Software Foundation; either version 3 of the License, or
	8	# (at your option) any later version.
	9	#
	10	# Koha is distributed in the hope that it will be useful, but
	11	# WITHOUT ANY WARRANTY; without even the implied warranty of
	12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	13	# GNU General Public License for more details.
	14	#
	15	# You should have received a copy of the GNU General Public License
	16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
	17
	18	use Modern::Perl;
	19
	20	require Mojolicious::Commands;
	21	Mojolicious::Commands->start_app('Koha::Mojo::Staff');

Line 0 Link Here

(-)a/t/db_dependent/Koha/Auth.t (+163 lines)
		1	#!/usr/bin/perl
		2
		3	use Modern::Perl;
		4	use C4::Auth qw( get_session );
		5	use Test::More tests => 8;
		6	use t::lib::TestBuilder;
		7	use t::lib::Mocks;
		8
		9	use Data::Dumper;
		10	use Koha::Database;
		11
		12	use_ok('Koha::Auth');
		13
		14	t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
		15
		16	my $schema = Koha::Database->new->schema;
		17	$schema->storage->txn_begin;
		18
		19	subtest 'Successful authentication' => sub {
		20	plan tests => 2;
		21
		22	$ENV{REMOTE_ADDR} = '127.0.0.1';
		23	my $builder = t::lib::TestBuilder->new;
		24	my $borrower = $builder->build( { source => 'Borrower' } );
		25	my $session = C4::Auth::get_session;
		26	$session->param( 'id', $borrower->{userid} );
		27	$session->param( 'lasttime', time() );
		28	$session->param( 'ip', '127.0.0.1' );
		29	$session->flush;
		30	my $sessionID = $session->id;
		31
		32	my ( $user, $user_session ) = Koha::Auth->authenticate(
		33	{
		34	sessionID => $sessionID,
		35	}
		36	);
		37	is( ref $user, 'Koha::Patron', 'User found' );
		38	is( ref $user_session, 'CGI::Session', 'User session found' );
		39
		40	$session->delete;
		41	};
		42
		43	subtest 'Failed authentication' => sub {
		44	plan tests => 2;
		45
		46	$ENV{REMOTE_ADDR} = '127.0.0.1';
		47	my $session = C4::Auth::get_session;
		48	$session->flush;
		49	$session->param( 'ip', '127.0.0.1' );
		50	my $sessionID = $session->id;
		51
		52	my ( $user, $user_session ) = Koha::Auth->authenticate(
		53	{
		54	sessionID => $sessionID,
		55	}
		56	);
		57	is( $user, undef, 'User not found' );
		58	is( $user_session, undef, 'User session not found' );
		59
		60	$session->delete;
		61	};
		62
		63	subtest 'Superlibrarian authorization' => sub {
		64	plan tests => 1;
65	my $builder = t::lib::TestBuilder->new;
66	my $borrower = $builder->build( { source => 'Borrower', value => { flags => 1, } } );
67
68	my $session = C4::Auth::get_session;
69	$session->param( 'id', $borrower->{userid} );
70	$session->param( 'lasttime', time() );
71	$session->param( 'ip', '127.0.0.1' );
72	$session->flush;
73
74	my $flags = Koha::Auth->authorize(
75	{
76	session => $session,
77	flagsrequired => { circulate => 1 },
78	}
79	);
80	is( $flags->{superlibrarian}, 1, 'Got superlibrarian authorization' );
81	};
82
83	subtest 'Circulation staff authorization' => sub {
84	plan tests => 2;
85	my $builder = t::lib::TestBuilder->new;
86	my $borrower = $builder->build( { source => 'Borrower', value => { flags => 2, } } );
87
88	my $session = C4::Auth::get_session;
89	$session->param( 'id', $borrower->{userid} );
90	$session->param( 'lasttime', time() );
91	$session->param( 'ip', '127.0.0.1' );
92	$session->flush;
93
94	my $flags = Koha::Auth->authorize(
95	{
96	session => $session,
97	flagsrequired => { circulate => 1 },
98	}
99	);
100	is( $flags->{superlibrarian}, 0, 'Did not get superlibrarian authorization' );
101	is( $flags->{circulate}, 1, 'Did get circulate authorization' );
102	};
103
104	subtest 'Public user not authorized for circulate authorization requirement' => sub {
105	plan tests => 1;
106	my $builder = t::lib::TestBuilder->new;
107	my $borrower = $builder->build( { source => 'Borrower', value => { flags => undef, } } );
108
109	my $session = C4::Auth::get_session;
110	$session->param( 'id', $borrower->{userid} );
111	$session->param( 'lasttime', time() );
112	$session->param( 'ip', '127.0.0.1' );
113	$session->flush;
114
115	my $flags = Koha::Auth->authorize(
116	{
117	session => $session,
118	flagsrequired => { circulate => 1 },
119	}
120	);
121	is( $flags, 0, 'Flags returned 0' );
122	};
123
124	subtest 'Staff user not authorized for circulate authorization requirement' => sub {
125	plan tests => 1;
126	my $builder = t::lib::TestBuilder->new;
127	my $borrower = $builder->build( { source => 'Borrower', value => { flags => 4, } } );
128
129	my $session = C4::Auth::get_session;
130	$session->param( 'id', $borrower->{userid} );
131	$session->param( 'lasttime', time() );
132	$session->param( 'ip', '127.0.0.1' );
133	$session->flush;
134
135	my $flags = Koha::Auth->authorize(
136	{
137	session => $session,
138	flagsrequired => { circulate => 1 },
139	}
140	);
141	is( $flags, 0, 'Flags returned 0' );
142	};
143
144	subtest 'No authorization required' => sub {
145	plan tests => 1;
146	my $builder = t::lib::TestBuilder->new;
147	my $borrower = $builder->build( { source => 'Borrower', value => { flags => undef, } } );
148
149	my $session = C4::Auth::get_session;
150	$session->param( 'id', $borrower->{userid} );
151	$session->param( 'lasttime', time() );
152	$session->param( 'ip', '127.0.0.1' );
153	$session->flush;
154
155	my $flags = Koha::Auth->authorize(
156	{
157	session => $session,
158	}
159	);
160	is( ref $flags, 'HASH', 'When no flags are required, a hashref is returned' );
161	};
162
163	$schema->storage->txn_rollback;

Line 0 Link Here

(-)a/t/db_dependent/Koha/Mojo/Plugins/Core.t (+119 lines)
		1	#!/usr/bin/perl
		2
		3	# This file is part of Koha.
		4	#
		5	# Koha is free software; you can redistribute it and/or modify it
		6	# under the terms of the GNU General Public License as published by
		7	# the Free Software Foundation; either version 3 of the License, or
		8	# (at your option) any later version.
		9	#
		10	# Koha is distributed in the hope that it will be useful, but
		11	# WITHOUT ANY WARRANTY; without even the implied warranty of
		12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		13	# GNU General Public License for more details.
		14	#
		15	# You should have received a copy of the GNU General Public License
		16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
		17
		18	use Modern::Perl;
		19
		20	# Dummy app for testing the plugin
		21	use Mojolicious::Lite;
		22	use Try::Tiny;
		23
		24	use C4::Auth qw//;
		25	use Koha::Patrons;
		26	use t::lib::TestBuilder;
		27	use t::lib::Mocks;
		28	t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
		29
		30	my $schema = Koha::Database->new->schema;
		31
		32	app->log->level('error');
		33
		34	plugin 'Koha::Mojo::Plugins::Core';
		35
		36	get '/get_helper_details' => sub {
		37	my $c = shift;
		38	try {
		39	my $authenticated = $c->koha->authenticate();
		40	my ( $flags, $loggedinuser ) = $c->koha->authorize();
		41	my $template = $c->koha->template(
		42	{
		43	template_filename => 'about.tt',
		44	interface => 'intranet',
		45	}
		46	);
		47	$c->render(
		48	json => {
		49	authenticated => $authenticated,
		50	flags => $flags,
		51	borrowernumber => $loggedinuser->borrowernumber,
		52	template => {
		53	output => $template->output,
		54	sessionID => $template->{VARS}->{sessionID},
		55	loggedinusernumber => $template->{VARS}->{loggedinusernumber},
		56	loggedinusername => $template->{VARS}->{loggedinusername},
		57	CAN_user_circulate => $template->{VARS}->{CAN_user_circulate},
		58	},
		59	},
		60	status => 200,
		61	);
		62	} catch {
		63	my $status = 500;
		64	if ( $_->isa('Koha::Exceptions::Authorization::Unauthorized') ) {
65	$status = 403;
66	}
67	$c->render( status => $status, text => '' );
68	};
69	};
70
71	sub to_model {
72	my ($args) = @_;
73	return $args;
74	}
75
76	# The tests
77
78	use Test::More tests => 2;
79	use Test::Mojo;
80
81	subtest 'Test core plugins with no session' => sub {
82
83	plan tests => 2;
84
85	my $t = Test::Mojo->new;
86	$t->get_ok('/get_helper_details')->status_is(403);
87	};
88
89	subtest 'Test core plugins with superlibrarian' => sub {
90	plan tests => 10;
91	$schema->storage->txn_begin;
92
93	my $builder = t::lib::TestBuilder->new;
94	my $borrower = $builder->build( { source => 'Borrower', value => { flags => 1, } } );
95	my $patron = Koha::Patrons->find( $borrower->{borrowernumber} );
96
97	my $remote_address = '127.0.0.1';
98	$ENV{REMOTE_ADDR} = $remote_address;
99	my $session = C4::Auth::get_session;
100	$session->param( 'id', $borrower->{userid} );
101	$session->param( 'lasttime', time() );
102	$session->param( 'ip', $remote_address );
103	$session->flush;
104
105	my $t = Test::Mojo->new;
106	my $tx = $t->ua->build_tx( GET => '/get_helper_details' );
107	$tx->req->cookies( { name => 'CGISESSID', value => $session->id } );
108	$tx->req->env( { REMOTE_ADDR => $remote_address } );
109	$t->request_ok($tx)->status_is(200)->json_is( '/authenticated' => 1, 'authenticated' )
110	->json_is( '/flags/superlibrarian' => 1, 'superlibrarian flag set' )
111	->json_is( '/borrowernumber' => $patron->borrowernumber, 'Borrower found' )
112	->json_has( '/template/output', 'template output set' )
113	->json_is( '/template/sessionID' => $session->id, 'sesssionID set' )
114	->json_is( '/template/loggedinusernumber' => $patron->borrowernumber, 'loggedinusernumber set' )
115	->json_is( '/template/loggedinusername' => $patron->userid, 'loggedinusername set' )
116	->json_is( '/template/CAN_user_circulate' => 1, 'template permissions set' );
117
118	$schema->storage->txn_rollback;
119	};

Line 0 Link Here

(-)a/t/db_dependent/Koha/Template.t (-1 / +65 lines)
0	-	1	#!/usr/bin/perl
		2
		3	use Modern::Perl;
		4	use C4::Auth qw( get_session );
		5	use Test::More tests => 2;
		6	use t::lib::TestBuilder;
		7	use t::lib::Mocks;
		8
		9	use Koha::Database;
		10	use Data::Dumper;
		11	use Koha::Auth;
		12	use Koha::Auth::Permissions;
		13	use Koha::Patrons;
		14	use_ok('Koha::Template');
		15
		16	t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
		17
		18	my $schema = Koha::Database->new->schema;
		19	$schema->storage->txn_begin;
		20
		21	subtest 'Prepare template' => sub {
		22	plan tests => 6;
		23
		24	$ENV{REMOTE_ADDR} = '127.0.0.1';
		25	my $builder = t::lib::TestBuilder->new;
		26	my $borrower = $builder->build( { source => 'Borrower', value => { flags => 2, } } );
		27	my $session = C4::Auth::get_session;
		28	$session->param( 'id', $borrower->{userid} );
		29	$session->param( 'lasttime', time() );
		30	$session->param( 'ip', '127.0.0.1' );
		31	$session->flush;
		32	my $sessionID = $session->id;
		33	my $flags = Koha::Auth->authorize(
		34	{
		35	session => $session,
		36	flagsrequired => { circulate => 1 },
		37	}
		38	);
		39	my $koha_authz = Koha::Auth::Permissions->get_authz_from_flags( { flags => $flags } );
		40	my $koha_user = Koha::Patrons->find( $borrower->{borrowernumber} );
		41
		42	my $htdocs = C4::Context->config('intrahtdocs');
		43	my $template_filename = $htdocs . '/prog/en/modules/about.tt';
		44	my $interface = "intranet";
		45	my $template = Koha::Template::prepare_template(
		46	{
		47	template_filename => $template_filename,
		48	interface => $interface,
		49	koha_session => $session,
		50	koha_user => $koha_user,
		51	koha_authz => $koha_authz,
		52	}
		53	);
		54
		55	ok( $template->output, 'Template generates output' );
		56	is( $template->{VARS}->{sessionID}, $session->id, 'sessionID set' );
		57	is( $template->{VARS}->{logged_in_user}, $koha_user, 'logged_in_user set' );
		58	is( $template->{VARS}->{loggedinusernumber}, $koha_user->borrowernumber, 'loggedinusernumber set' );
		59	is( $template->{VARS}->{loggedinusername}, $koha_user->userid, 'loggedinusername set' );
		60	is( $template->{VARS}->{CAN_user_circulate}, 1, 'CAN_user_circulate set' );
		61
		62	$session->delete;
		63	};
		64
		65	$schema->storage->txn_rollback;