View | Details | Raw Unified | Return to bug 38050
Collapse All | Expand All

(-)a/Koha/REST/V1/Lists.pm (-1 / +210 lines)
Lines 163-168 sub delete { Link Here
163
    };
163
    };
164
}
164
}
165
165
166
=head3 public_add
167
168
Create a public virtual shelf
169
170
=cut
171
172
sub public_add {
173
    my $c = shift->openapi->valid_input or return;
174
175
    my $user = $c->stash('koha.user');
176
177
    # Handle anonymous users first
178
    unless ($user) {
179
        return $c->render(
180
            status  => 401,
181
            openapi => {
182
                error      => "Authentication required",
183
                error_code => "authentication_required"
184
            }
185
        );
186
    }
187
188
    my $body = $c->req->json;
189
    $body->{owner} = $user->id;
190
191
    return try {
192
        my $list = Koha::Virtualshelf->new_from_api($body);
193
        $list->store->discard_changes;
194
195
        $c->res->headers->location( $c->req->url->to_string . '/' . $list->id );
196
197
        return $c->render(
198
            status  => 201,
199
            openapi => $list->to_api
200
        );
201
    } catch {
202
        $c->unhandled_exception($_);
203
    };
204
}
205
206
=head3 public_get
207
208
List the contents of a public virtual shelf or a virtual shelf you own
209
210
=cut
211
212
sub public_get {
213
    my $c = shift->openapi->valid_input or return;
214
215
    return try {
216
        my $list = Koha::Virtualshelves->find( $c->param('list_id') );
217
218
        return $c->render_resource_not_found("List")
219
            unless $list;
220
221
        my $user = $c->stash('koha.user');
222
223
        # If no user is logged in, only allow access to public lists
224
        unless ($user) {
225
            return $c->render(
226
                status  => 403,
227
                openapi => {
228
                    error      => "Forbidden - anonymous users can only view public lists",
229
                    error_code => "forbidden"
230
                }
231
            ) unless $list->public;
232
233
            return $c->render(
234
                status  => 200,
235
                openapi => $list->to_api
236
            );
237
        }
238
239
        # For logged in users, check ownership and public status
240
        unless ( $list->owner == $user->id || $list->public == 1 ) {
241
            return $c->render(
242
                status  => 403,
243
                openapi => {
244
                    error      => "Forbidden - you can only view your own lists or public lists",
245
                    error_code => "forbidden"
246
                }
247
            );
248
        }
249
250
        return $c->render(
251
            status  => 200,
252
            openapi => $list->to_api
253
        );
254
    } catch {
255
        $c->unhandled_exception($_);
256
    };
257
}
258
259
=head3 public_update
260
261
Update a public virtual shelf or a shelf you own
262
263
=cut
264
265
sub public_update {
266
    my $c = shift->openapi->valid_input or return;
267
268
    my $user = $c->stash('koha.user');
269
270
    # Handle anonymous users first
271
    unless ($user) {
272
        return $c->render(
273
            status  => 401,
274
            openapi => {
275
                error      => "Authentication required",
276
                error_code => "authentication_required"
277
            }
278
        );
279
    }
280
281
    my $list = Koha::Virtualshelves->find( $c->param('list_id') );
282
283
    return $c->render_resource_not_found("List")
284
        unless $list;
285
286
    if ( $list->owner != $user->id ) {
287
        return $c->render(
288
            status  => 403,
289
            openapi => {
290
                error      => "Forbidden - you can only update your own lists",
291
                error_code => "forbidden"
292
            }
293
        );
294
    }
295
296
    if ( $list->allow_change_from_owner == 0 ) {
297
        return $c->render(
298
            status  => 403,
299
            openapi => {
300
                error      => "Forbidden - you can't update this list",
301
                error_code => "forbidden"
302
            }
303
        );
304
    }
305
306
    return try {
307
        $list->set_from_api( $c->req->json );
308
        $list->store();
309
310
        return $c->render(
311
            status  => 200,
312
            openapi => $list->to_api
313
        );
314
    } catch {
315
        $c->unhandled_exception($_);
316
    };
317
}
318
319
=head3 public_delete
320
321
Delete a public virtual shelf you own
322
323
=cut
324
325
sub public_delete {
326
    my $c = shift->openapi->valid_input or return;
327
328
    my $user = $c->stash('koha.user');
329
330
    # Handle anonymous users first
331
    unless ($user) {
332
        return $c->render(
333
            status  => 401,
334
            openapi => {
335
                error      => "Authentication required",
336
                error_code => "authentication_required"
337
            }
338
        );
339
    }
340
341
    my $list = Koha::Virtualshelves->find( $c->param('list_id') );
342
343
    return $c->render_resource_not_found("List")
344
        unless $list;
345
346
    # Check ownership
347
    if ( $list->owner != $user->id ) {
348
        return $c->render(
349
            status  => 403,
350
            openapi => {
351
                error      => "Forbidden - you can only delete your own lists",
352
                error_code => "forbidden"
353
            }
354
        );
355
    }
356
357
    # Check if modifications allowed
358
    if ( $list->allow_change_from_owner == 0 ) {
359
        return $c->render(
360
            status  => 403,
361
            openapi => {
362
                error      => "Forbidden - you can't delete this list",
363
                error_code => "forbidden"
364
            }
365
        );
366
    }
367
368
    return try {
369
        $list->delete;
370
        return $c->render_resource_deleted;
371
    } catch {
372
        $c->unhandled_exception($_);
373
    };
374
}
375
166
=head3 list_public
376
=head3 list_public
167
377
168
=cut
378
=cut
169
- 

Return to bug 38050