View | Details | Raw Unified | Return to bug 28907
Collapse All | Expand All

(-)a/Koha/REST/V1/Patrons.pm (+4 lines)
Lines 456-461 sub guarantors_can_see_charges { Link Here
456
    my $c = shift->openapi->valid_input or return;
456
    my $c = shift->openapi->valid_input or return;
457
457
458
    return try {
458
    return try {
459
        $c->auth->public( $c->param('patron_id') );
460
459
        if ( C4::Context->preference('AllowPatronToSetFinesVisibilityForGuarantor') ) {
461
        if ( C4::Context->preference('AllowPatronToSetFinesVisibilityForGuarantor') ) {
460
            my $patron = $c->stash( 'koha.user' );
462
            my $patron = $c->stash( 'koha.user' );
461
            my $privacy_setting = ($c->req->json->{allowed}) ? 1 : 0;
463
            my $privacy_setting = ($c->req->json->{allowed}) ? 1 : 0;
Lines 492-497 sub guarantors_can_see_checkouts { Link Here
492
    my $c = shift->openapi->valid_input or return;
494
    my $c = shift->openapi->valid_input or return;
493
495
494
    return try {
496
    return try {
497
        $c->auth->public( $c->param('patron_id') );
498
495
        if ( C4::Context->preference('AllowPatronToSetCheckoutsVisibilityForGuarantor') ) {
499
        if ( C4::Context->preference('AllowPatronToSetCheckoutsVisibilityForGuarantor') ) {
496
            my $patron = $c->stash( 'koha.user' );
500
            my $patron = $c->stash( 'koha.user' );
497
            my $privacy_setting = ( $c->req->json->{allowed} ) ? 1 : 0;
501
            my $privacy_setting = ( $c->req->json->{allowed} ) ? 1 : 0;
(-)a/api/v1/swagger/paths/public_patrons.yaml (-4 lines)
Lines 182-189 Link Here
182
        description: Under maintenance
182
        description: Under maintenance
183
        schema:
183
        schema:
184
          $ref: "../swagger.yaml#/definitions/error"
184
          $ref: "../swagger.yaml#/definitions/error"
185
    x-koha-authorization:
186
      allow-owner: true
187
"/public/patrons/{patron_id}/guarantors/can_see_checkouts":
185
"/public/patrons/{patron_id}/guarantors/can_see_checkouts":
188
  put:
186
  put:
189
    x-mojo-to: Patrons#guarantors_can_see_checkouts
187
    x-mojo-to: Patrons#guarantors_can_see_checkouts
Lines 236-243 Link Here
236
        description: Under maintenance
234
        description: Under maintenance
237
        schema:
235
        schema:
238
          $ref: "../swagger.yaml#/definitions/error"
236
          $ref: "../swagger.yaml#/definitions/error"
239
    x-koha-authorization:
240
      allow-owner: true
241
"/public/patrons/{patron_id}/holds/{hold_id}":
237
"/public/patrons/{patron_id}/holds/{hold_id}":
242
  delete:
238
  delete:
243
    x-mojo-to: Patrons::Holds#delete_public
239
    x-mojo-to: Patrons::Holds#delete_public
(-)a/t/db_dependent/api/v1/patrons.t (-3 / +19 lines)
Lines 1160-1166 subtest 'delete() tests' => sub { Link Here
1160
1160
1161
subtest 'guarantors_can_see_charges() tests' => sub {
1161
subtest 'guarantors_can_see_charges() tests' => sub {
1162
1162
1163
    plan tests => 11;
1163
    plan tests => 17;
1164
1164
1165
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
1165
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
1166
    t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
1166
    t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
Lines 1168-1173 subtest 'guarantors_can_see_charges() tests' => sub { Link Here
1168
    $schema->storage->txn_begin;
1168
    $schema->storage->txn_begin;
1169
1169
1170
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { privacy_guarantor_fines => 0 } });
1170
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { privacy_guarantor_fines => 0 } });
1171
    my $other_patron_id = $builder->build_object( { class => 'Koha::Patrons' } )->borrowernumber;
1171
    my $password = 'thePassword123';
1172
    my $password = 'thePassword123';
1172
    $patron->set_password({ password => $password, skip_validation => 1 });
1173
    $patron->set_password({ password => $password, skip_validation => 1 });
1173
    my $userid = $patron->userid;
1174
    my $userid = $patron->userid;
Lines 1175-1180 subtest 'guarantors_can_see_charges() tests' => sub { Link Here
1175
1176
1176
    t::lib::Mocks::mock_preference( 'AllowPatronToSetFinesVisibilityForGuarantor', 0 );
1177
    t::lib::Mocks::mock_preference( 'AllowPatronToSetFinesVisibilityForGuarantor', 0 );
1177
1178
1179
    $t->put_ok(
1180
        "/api/v1/public/patrons/$other_patron_id/guarantors/can_see_charges" => json => { allowed => Mojo::JSON->true }
1181
    )->status_is(401)->json_is( { error => "Authentication failure." } );
1182
1183
    $t->put_ok( "//$userid:$password@/api/v1/public/patrons/$other_patron_id/guarantors/can_see_charges" => json =>
1184
            { allowed => Mojo::JSON->true } )->status_is(403)
1185
        ->json_is( { error => "Unprivileged user cannot access another user's resources" } );
1186
1178
    $t->put_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/guarantors/can_see_charges" => json => { allowed => Mojo::JSON->true } )
1187
    $t->put_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/guarantors/can_see_charges" => json => { allowed => Mojo::JSON->true } )
1179
      ->status_is( 403 )
1188
      ->status_is( 403 )
1180
      ->json_is( '/error', 'The current configuration doesn\'t allow the requested action.' );
1189
      ->json_is( '/error', 'The current configuration doesn\'t allow the requested action.' );
Lines 1198-1204 subtest 'guarantors_can_see_charges() tests' => sub { Link Here
1198
1207
1199
subtest 'guarantors_can_see_checkouts() tests' => sub {
1208
subtest 'guarantors_can_see_checkouts() tests' => sub {
1200
1209
1201
    plan tests => 11;
1210
    plan tests => 17;
1202
1211
1203
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
1212
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
1204
    t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
1213
    t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
Lines 1206-1216 subtest 'guarantors_can_see_checkouts() tests' => sub { Link Here
1206
    $schema->storage->txn_begin;
1215
    $schema->storage->txn_begin;
1207
1216
1208
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { privacy_guarantor_checkouts => 0 } });
1217
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { privacy_guarantor_checkouts => 0 } });
1218
    my $other_patron_id = $builder->build_object( { class => 'Koha::Patrons' } )->borrowernumber;
1209
    my $password = 'thePassword123';
1219
    my $password = 'thePassword123';
1210
    $patron->set_password({ password => $password, skip_validation => 1 });
1220
    $patron->set_password({ password => $password, skip_validation => 1 });
1211
    my $userid = $patron->userid;
1221
    my $userid = $patron->userid;
1212
    my $patron_id = $patron->borrowernumber;
1222
    my $patron_id = $patron->borrowernumber;
1213
1223
1224
    $t->put_ok( "/api/v1/public/patrons/$other_patron_id/guarantors/can_see_checkouts" => json =>
1225
            { allowed => Mojo::JSON->true } )->status_is(401)->json_is( { error => "Authentication failure." } );
1226
1227
    $t->put_ok( "//$userid:$password@/api/v1/public/patrons/$other_patron_id/guarantors/can_see_checkouts" => json =>
1228
            { allowed => Mojo::JSON->true } )->status_is(403)
1229
        ->json_is( { error => "Unprivileged user cannot access another user's resources" } );
1230
1214
    t::lib::Mocks::mock_preference( 'AllowPatronToSetCheckoutsVisibilityForGuarantor', 0 );
1231
    t::lib::Mocks::mock_preference( 'AllowPatronToSetCheckoutsVisibilityForGuarantor', 0 );
1215
1232
1216
    $t->put_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/guarantors/can_see_checkouts" => json => { allowed => Mojo::JSON->true } )
1233
    $t->put_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/guarantors/can_see_checkouts" => json => { allowed => Mojo::JSON->true } )
1217
- 

Return to bug 28907