Lines 163-168
sub delete {
Link Here
|
163 |
}; |
163 |
}; |
164 |
} |
164 |
} |
165 |
|
165 |
|
|
|
166 |
=head3 public_add |
167 |
|
168 |
Create a public virtual shelf |
169 |
|
170 |
=cut |
171 |
|
172 |
sub public_add { |
173 |
my $c = shift->openapi->valid_input or return; |
174 |
|
175 |
my $user = $c->stash('koha.user'); |
176 |
|
177 |
# Handle anonymous users first |
178 |
unless ($user) { |
179 |
return $c->render( |
180 |
status => 401, |
181 |
openapi => { |
182 |
error => "Authentication required", |
183 |
error_code => "authentication_required" |
184 |
} |
185 |
); |
186 |
} |
187 |
|
188 |
my $body = $c->req->json; |
189 |
$body->{owner} = $user->id; |
190 |
|
191 |
return try { |
192 |
my $list = Koha::Virtualshelf->new_from_api($body); |
193 |
$list->store->discard_changes; |
194 |
|
195 |
$c->res->headers->location( $c->req->url->to_string . '/' . $list->id ); |
196 |
|
197 |
return $c->render( |
198 |
status => 201, |
199 |
openapi => $list->to_api |
200 |
); |
201 |
} catch { |
202 |
$c->unhandled_exception($_); |
203 |
}; |
204 |
} |
205 |
|
206 |
=head3 public_get |
207 |
|
208 |
List the contents of a public virtual shelf or a virtual shelf you own |
209 |
|
210 |
=cut |
211 |
|
212 |
sub public_get { |
213 |
my $c = shift->openapi->valid_input or return; |
214 |
|
215 |
return try { |
216 |
my $list = Koha::Virtualshelves->find( $c->param('list_id') ); |
217 |
|
218 |
return $c->render_resource_not_found("List") |
219 |
unless $list; |
220 |
|
221 |
my $user = $c->stash('koha.user'); |
222 |
|
223 |
# If no user is logged in, only allow access to public lists |
224 |
unless ($user) { |
225 |
return $c->render( |
226 |
status => 403, |
227 |
openapi => { |
228 |
error => "Forbidden - anonymous users can only view public lists", |
229 |
error_code => "forbidden" |
230 |
} |
231 |
) unless $list->public; |
232 |
|
233 |
return $c->render( |
234 |
status => 200, |
235 |
openapi => $list->to_api |
236 |
); |
237 |
} |
238 |
|
239 |
# For logged in users, check ownership and public status |
240 |
unless ( $list->owner == $user->id || $list->public == 1 ) { |
241 |
return $c->render( |
242 |
status => 403, |
243 |
openapi => { |
244 |
error => "Forbidden - you can only view your own lists or public lists", |
245 |
error_code => "forbidden" |
246 |
} |
247 |
); |
248 |
} |
249 |
|
250 |
return $c->render( |
251 |
status => 200, |
252 |
openapi => $list->to_api |
253 |
); |
254 |
} catch { |
255 |
$c->unhandled_exception($_); |
256 |
}; |
257 |
} |
258 |
|
259 |
=head3 public_update |
260 |
|
261 |
Update a public virtual shelf or a shelf you own |
262 |
|
263 |
=cut |
264 |
|
265 |
sub public_update { |
266 |
my $c = shift->openapi->valid_input or return; |
267 |
|
268 |
my $user = $c->stash('koha.user'); |
269 |
|
270 |
# Handle anonymous users first |
271 |
unless ($user) { |
272 |
return $c->render( |
273 |
status => 401, |
274 |
openapi => { |
275 |
error => "Authentication required", |
276 |
error_code => "authentication_required" |
277 |
} |
278 |
); |
279 |
} |
280 |
|
281 |
my $list = Koha::Virtualshelves->find( $c->param('list_id') ); |
282 |
|
283 |
return $c->render_resource_not_found("List") |
284 |
unless $list; |
285 |
|
286 |
if ( $list->owner != $user->id ) { |
287 |
return $c->render( |
288 |
status => 403, |
289 |
openapi => { |
290 |
error => "Forbidden - you can only update your own lists", |
291 |
error_code => "forbidden" |
292 |
} |
293 |
); |
294 |
} |
295 |
|
296 |
if ( $list->allow_change_from_owner == 0 ) { |
297 |
return $c->render( |
298 |
status => 403, |
299 |
openapi => { |
300 |
error => "Forbidden - you can't update this list", |
301 |
error_code => "forbidden" |
302 |
} |
303 |
); |
304 |
} |
305 |
|
306 |
return try { |
307 |
$list->set_from_api( $c->req->json ); |
308 |
$list->store(); |
309 |
|
310 |
return $c->render( |
311 |
status => 200, |
312 |
openapi => $list->to_api |
313 |
); |
314 |
} catch { |
315 |
$c->unhandled_exception($_); |
316 |
}; |
317 |
} |
318 |
|
319 |
=head3 public_delete |
320 |
|
321 |
Delete a public virtual shelf you own |
322 |
|
323 |
=cut |
324 |
|
325 |
sub public_delete { |
326 |
my $c = shift->openapi->valid_input or return; |
327 |
|
328 |
my $user = $c->stash('koha.user'); |
329 |
|
330 |
# Handle anonymous users first |
331 |
unless ($user) { |
332 |
return $c->render( |
333 |
status => 401, |
334 |
openapi => { |
335 |
error => "Authentication required", |
336 |
error_code => "authentication_required" |
337 |
} |
338 |
); |
339 |
} |
340 |
|
341 |
my $list = Koha::Virtualshelves->find( $c->param('list_id') ); |
342 |
|
343 |
return $c->render_resource_not_found("List") |
344 |
unless $list; |
345 |
|
346 |
# Check ownership |
347 |
if ( $list->owner != $user->id ) { |
348 |
return $c->render( |
349 |
status => 403, |
350 |
openapi => { |
351 |
error => "Forbidden - you can only delete your own lists", |
352 |
error_code => "forbidden" |
353 |
} |
354 |
); |
355 |
} |
356 |
|
357 |
# Check if modifications allowed |
358 |
if ( $list->allow_change_from_owner == 0 ) { |
359 |
return $c->render( |
360 |
status => 403, |
361 |
openapi => { |
362 |
error => "Forbidden - you can't delete this list", |
363 |
error_code => "forbidden" |
364 |
} |
365 |
); |
366 |
} |
367 |
|
368 |
return try { |
369 |
$list->delete; |
370 |
return $c->render_resource_deleted; |
371 |
} catch { |
372 |
$c->unhandled_exception($_); |
373 |
}; |
374 |
} |
375 |
|
166 |
=head3 list_public |
376 |
=head3 list_public |
167 |
|
377 |
|
168 |
=cut |
378 |
=cut |
169 |
- |
|
|