Line 0
Link Here
|
0 |
- |
1 |
#!/usr/bin/perl |
|
|
2 |
|
3 |
# Copyright 2024 Hypernova Oy |
4 |
# |
5 |
# This file is part of Koha |
6 |
# |
7 |
# Koha is free software; you can redistribute it and/or modify it |
8 |
# under the terms of the GNU General Public License as published by |
9 |
# the Free Software Foundation; either version 3 of the License, or |
10 |
# (at your option) any later version. |
11 |
# |
12 |
# Koha is distributed in the hope that it will be useful, but |
13 |
# WITHOUT ANY WARRANTY; without even the implied warranty of |
14 |
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
15 |
# GNU General Public License for more details. |
16 |
# |
17 |
# You should have received a copy of the GNU General Public License |
18 |
# along with Koha; if not, see <http://www.gnu.org/licenses>. |
19 |
|
20 |
use Modern::Perl; |
21 |
|
22 |
use Koha::Patrons; |
23 |
use Try::Tiny; |
24 |
|
25 |
# Dummy app for testing the plugin |
26 |
use Mojolicious::Lite; |
27 |
|
28 |
plugin 'Koha::REST::Plugin::Auth::PublicRoutes'; |
29 |
|
30 |
post '/public' => sub { |
31 |
my $c = shift; |
32 |
my $params = $c->req->json; |
33 |
|
34 |
$c->stash( 'koha.user' => Koha::Patrons->find( $params->{'user'} ) ); |
35 |
$c->stash( 'is_public' => 1 ); |
36 |
|
37 |
try { |
38 |
my $patron_id = $params->{'patron_id'}; |
39 |
$c->auth->public($patron_id); |
40 |
$c->render( status => 200, json => "OK" ); |
41 |
} catch { |
42 |
if ( ref($_) eq 'Koha::Exceptions::REST::Public::Authentication::Required' ) { |
43 |
$c->render( status => 401, json => { message => 'authentication_required' } ); |
44 |
} elsif ( ref($_) eq 'Koha::Exceptions::REST::Public::Unauthorized' ) { |
45 |
$c->render( status => 403, json => { message => 'unauthorized' } ); |
46 |
} else { |
47 |
$c->render( status => 500, json => { message => 'other error' } ); |
48 |
} |
49 |
} |
50 |
}; |
51 |
|
52 |
post '/public_guarantor' => sub { |
53 |
my $c = shift; |
54 |
my $params = $c->req->json; |
55 |
|
56 |
$c->stash( 'koha.user' => Koha::Patrons->find( $params->{'user'} ) ); |
57 |
$c->stash( 'is_public' => 1 ); |
58 |
|
59 |
try { |
60 |
my $patron_id = $params->{'patron_id'}; |
61 |
$c->auth->public_guarantor($patron_id); |
62 |
$c->render( status => 200, json => "OK" ); |
63 |
} catch { |
64 |
if ( ref($_) eq 'Koha::Exceptions::REST::Public::Authentication::Required' ) { |
65 |
$c->render( status => 401, json => { message => 'authentication_required' } ); |
66 |
} elsif ( ref($_) eq 'Koha::Exceptions::REST::Public::Unauthorized' ) { |
67 |
$c->render( status => 403, json => { message => 'unauthorized' } ); |
68 |
} else { |
69 |
$c->render( status => 500, json => { message => 'other error' } ); |
70 |
} |
71 |
} |
72 |
}; |
73 |
|
74 |
use Test::More tests => 2; |
75 |
use Test::Mojo; |
76 |
|
77 |
use t::lib::Mocks; |
78 |
use t::lib::TestBuilder; |
79 |
use Koha::Database; |
80 |
|
81 |
my $schema = Koha::Database->new()->schema(); |
82 |
my $builder = t::lib::TestBuilder->new; |
83 |
|
84 |
# FIXME: sessionStorage defaults to mysql, but it seems to break transaction handling |
85 |
# this affects the other REST api tests |
86 |
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' ); |
87 |
|
88 |
subtest 'auth.public helper' => sub { |
89 |
plan tests => 9; |
90 |
|
91 |
$schema->storage->txn_begin; |
92 |
|
93 |
my $unprivileged_patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
94 |
my $another_patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
95 |
|
96 |
my $t = Test::Mojo->new; |
97 |
|
98 |
$t->post_ok( '/public' => json => { patron_id => $another_patron->borrowernumber } )->status_is(401) |
99 |
->json_is( { message => 'authentication_required' } ); |
100 |
|
101 |
$t->post_ok( '/public' => json => |
102 |
{ user => $unprivileged_patron->borrowernumber, patron_id => $another_patron->borrowernumber } ) |
103 |
->status_is(403)->json_is( { message => 'unauthorized' } ); |
104 |
|
105 |
$t->post_ok( '/public' => json => |
106 |
{ user => $unprivileged_patron->borrowernumber, patron_id => $unprivileged_patron->borrowernumber } ) |
107 |
->status_is(200)->json_is('OK'); |
108 |
|
109 |
$schema->storage->txn_rollback; |
110 |
}; |
111 |
|
112 |
subtest 'auth.public_guarantor helper' => sub { |
113 |
plan tests => 12; |
114 |
|
115 |
$schema->storage->txn_begin; |
116 |
|
117 |
t::lib::Mocks::mock_preference( 'borrowerRelationship', 'test' ); |
118 |
|
119 |
my $guarantee = $builder->build_object( { class => 'Koha::Patrons' } ); |
120 |
my $guarantor = $builder->build_object( { class => 'Koha::Patrons' } ); |
121 |
$guarantee->add_guarantor( { guarantor_id => $guarantor->borrowernumber, relationship => 'test' } ); |
122 |
my $another_patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
123 |
|
124 |
my $t = Test::Mojo->new; |
125 |
|
126 |
$t->post_ok( '/public_guarantor' => json => { patron_id => $another_patron->borrowernumber } )->status_is(401) |
127 |
->json_is( { message => 'authentication_required' } ); |
128 |
|
129 |
$t->post_ok( '/public_guarantor' => json => |
130 |
{ user => $guarantor->borrowernumber, patron_id => $another_patron->borrowernumber } )->status_is(403) |
131 |
->json_is( { message => 'unauthorized' } ); |
132 |
|
133 |
# user is not a guarantor of themself |
134 |
$t->post_ok( |
135 |
'/public_guarantor' => json => { user => $guarantor->borrowernumber, patron_id => $guarantor->borrowernumber } ) |
136 |
->status_is(403)->json_is( { message => 'unauthorized' } ); |
137 |
|
138 |
$t->post_ok( |
139 |
'/public_guarantor' => json => { user => $guarantor->borrowernumber, patron_id => $guarantee->borrowernumber } ) |
140 |
->status_is(200)->json_is('OK'); |
141 |
|
142 |
$schema->storage->txn_rollback; |
143 |
}; |
144 |
|
145 |
1; |