| Lines 163-168
          sub delete {
      
      
        Link Here | 
        
          | 163 |     }; | 163 |     }; | 
        
          | 164 | } | 164 | } | 
        
          | 165 |  | 165 |  | 
            
              |  |  | 166 | =head3 public_add | 
            
              | 167 |  | 
            
              | 168 | Create a public virtual shelf | 
            
              | 169 |  | 
            
              | 170 | =cut | 
            
              | 171 |  | 
            
              | 172 | sub public_add { | 
            
              | 173 |     my $c = shift->openapi->valid_input or return; | 
            
              | 174 |  | 
            
              | 175 |     my $user = $c->stash('koha.user'); | 
            
              | 176 |  | 
            
              | 177 |     # Handle anonymous users first | 
            
              | 178 |     unless ($user) { | 
            
              | 179 |         return $c->render( | 
            
              | 180 |             status  => 401, | 
            
              | 181 |             openapi => { | 
            
              | 182 |                 error      => "Authentication required", | 
            
              | 183 |                 error_code => "authentication_required" | 
            
              | 184 |             } | 
            
              | 185 |         ); | 
            
              | 186 |     } | 
            
              | 187 |  | 
            
              | 188 |     my $body = $c->req->json; | 
            
              | 189 |     $body->{owner} = $user->id; | 
            
              | 190 |  | 
            
              | 191 |     return try { | 
            
              | 192 |         my $list = Koha::Virtualshelf->new_from_api($body); | 
            
              | 193 |         $list->store->discard_changes; | 
            
              | 194 |  | 
            
              | 195 |         $c->res->headers->location( $c->req->url->to_string . '/' . $list->id ); | 
            
              | 196 |  | 
            
              | 197 |         return $c->render( | 
            
              | 198 |             status  => 201, | 
            
              | 199 |             openapi => $list->to_api | 
            
              | 200 |         ); | 
            
              | 201 |     } catch { | 
            
              | 202 |         $c->unhandled_exception($_); | 
            
              | 203 |     }; | 
            
              | 204 | } | 
            
              | 205 |  | 
            
              | 206 | =head3 public_get | 
            
              | 207 |  | 
            
              | 208 | List the contents of a public virtual shelf or a virtual shelf you own | 
            
              | 209 |  | 
            
              | 210 | =cut | 
            
              | 211 |  | 
            
              | 212 | sub public_get { | 
            
              | 213 |     my $c = shift->openapi->valid_input or return; | 
            
              | 214 |  | 
            
              | 215 |     return try { | 
            
              | 216 |         my $list = Koha::Virtualshelves->find( $c->param('list_id') ); | 
            
              | 217 |  | 
            
              | 218 |         return $c->render_resource_not_found("List") | 
            
              | 219 |             unless $list; | 
            
              | 220 |  | 
            
              | 221 |         my $user = $c->stash('koha.user'); | 
            
              | 222 |  | 
            
              | 223 |         # If no user is logged in, only allow access to public lists | 
            
              | 224 |         unless ($user) { | 
            
              | 225 |             return $c->render( | 
            
              | 226 |                 status  => 403, | 
            
              | 227 |                 openapi => { | 
            
              | 228 |                     error      => "Forbidden - anonymous users can only view public lists", | 
            
              | 229 |                     error_code => "forbidden" | 
            
              | 230 |                 } | 
            
              | 231 |             ) unless $list->public; | 
            
              | 232 |  | 
            
              | 233 |             return $c->render( | 
            
              | 234 |                 status  => 200, | 
            
              | 235 |                 openapi => $list->to_api | 
            
              | 236 |             ); | 
            
              | 237 |         } | 
            
              | 238 |  | 
            
              | 239 |         # For logged in users, check ownership and public status | 
            
              | 240 |         unless ( $list->owner == $user->id || $list->public == 1 ) { | 
            
              | 241 |             return $c->render( | 
            
              | 242 |                 status  => 403, | 
            
              | 243 |                 openapi => { | 
            
              | 244 |                     error      => "Forbidden - you can only view your own lists or public lists", | 
            
              | 245 |                     error_code => "forbidden" | 
            
              | 246 |                 } | 
            
              | 247 |             ); | 
            
              | 248 |         } | 
            
              | 249 |  | 
            
              | 250 |         return $c->render( | 
            
              | 251 |             status  => 200, | 
            
              | 252 |             openapi => $list->to_api | 
            
              | 253 |         ); | 
            
              | 254 |     } catch { | 
            
              | 255 |         $c->unhandled_exception($_); | 
            
              | 256 |     }; | 
            
              | 257 | } | 
            
              | 258 |  | 
            
              | 259 | =head3 public_update | 
            
              | 260 |  | 
            
              | 261 | Update a public virtual shelf or a shelf you own | 
            
              | 262 |  | 
            
              | 263 | =cut | 
            
              | 264 |  | 
            
              | 265 | sub public_update { | 
            
              | 266 |     my $c = shift->openapi->valid_input or return; | 
            
              | 267 |  | 
            
              | 268 |     my $user = $c->stash('koha.user'); | 
            
              | 269 |  | 
            
              | 270 |     # Handle anonymous users first | 
            
              | 271 |     unless ($user) { | 
            
              | 272 |         return $c->render( | 
            
              | 273 |             status  => 401, | 
            
              | 274 |             openapi => { | 
            
              | 275 |                 error      => "Authentication required", | 
            
              | 276 |                 error_code => "authentication_required" | 
            
              | 277 |             } | 
            
              | 278 |         ); | 
            
              | 279 |     } | 
            
              | 280 |  | 
            
              | 281 |     my $list = Koha::Virtualshelves->find( $c->param('list_id') ); | 
            
              | 282 |  | 
            
              | 283 |     return $c->render_resource_not_found("List") | 
            
              | 284 |         unless $list; | 
            
              | 285 |  | 
            
              | 286 |     if ( $list->owner != $user->id ) { | 
            
              | 287 |         return $c->render( | 
            
              | 288 |             status  => 403, | 
            
              | 289 |             openapi => { | 
            
              | 290 |                 error      => "Forbidden - you can only update your own lists", | 
            
              | 291 |                 error_code => "forbidden" | 
            
              | 292 |             } | 
            
              | 293 |         ); | 
            
              | 294 |     } | 
            
              | 295 |  | 
            
              | 296 |     if ( $list->allow_change_from_owner == 0 ) { | 
            
              | 297 |         return $c->render( | 
            
              | 298 |             status  => 403, | 
            
              | 299 |             openapi => { | 
            
              | 300 |                 error      => "Forbidden - you can't update this list", | 
            
              | 301 |                 error_code => "forbidden" | 
            
              | 302 |             } | 
            
              | 303 |         ); | 
            
              | 304 |     } | 
            
              | 305 |  | 
            
              | 306 |     return try { | 
            
              | 307 |         $list->set_from_api( $c->req->json ); | 
            
              | 308 |         $list->store(); | 
            
              | 309 |  | 
            
              | 310 |         return $c->render( | 
            
              | 311 |             status  => 200, | 
            
              | 312 |             openapi => $list->to_api | 
            
              | 313 |         ); | 
            
              | 314 |     } catch { | 
            
              | 315 |         $c->unhandled_exception($_); | 
            
              | 316 |     }; | 
            
              | 317 | } | 
            
              | 318 |  | 
            
              | 319 | =head3 public_delete | 
            
              | 320 |  | 
            
              | 321 | Delete a public virtual shelf you own | 
            
              | 322 |  | 
            
              | 323 | =cut | 
            
              | 324 |  | 
            
              | 325 | sub public_delete { | 
            
              | 326 |     my $c = shift->openapi->valid_input or return; | 
            
              | 327 |  | 
            
              | 328 |     my $user = $c->stash('koha.user'); | 
            
              | 329 |  | 
            
              | 330 |     # Handle anonymous users first | 
            
              | 331 |     unless ($user) { | 
            
              | 332 |         return $c->render( | 
            
              | 333 |             status  => 401, | 
            
              | 334 |             openapi => { | 
            
              | 335 |                 error      => "Authentication required", | 
            
              | 336 |                 error_code => "authentication_required" | 
            
              | 337 |             } | 
            
              | 338 |         ); | 
            
              | 339 |     } | 
            
              | 340 |  | 
            
              | 341 |     my $list = Koha::Virtualshelves->find( $c->param('list_id') ); | 
            
              | 342 |  | 
            
              | 343 |     return $c->render_resource_not_found("List") | 
            
              | 344 |         unless $list; | 
            
              | 345 |  | 
            
              | 346 |     # Check ownership | 
            
              | 347 |     if ( $list->owner != $user->id ) { | 
            
              | 348 |         return $c->render( | 
            
              | 349 |             status  => 403, | 
            
              | 350 |             openapi => { | 
            
              | 351 |                 error      => "Forbidden - you can only delete your own lists", | 
            
              | 352 |                 error_code => "forbidden" | 
            
              | 353 |             } | 
            
              | 354 |         ); | 
            
              | 355 |     } | 
            
              | 356 |  | 
            
              | 357 |     # Check if modifications allowed | 
            
              | 358 |     if ( $list->allow_change_from_owner == 0 ) { | 
            
              | 359 |         return $c->render( | 
            
              | 360 |             status  => 403, | 
            
              | 361 |             openapi => { | 
            
              | 362 |                 error      => "Forbidden - you can't delete this list", | 
            
              | 363 |                 error_code => "forbidden" | 
            
              | 364 |             } | 
            
              | 365 |         ); | 
            
              | 366 |     } | 
            
              | 367 |  | 
            
              | 368 |     return try { | 
            
              | 369 |         $list->delete; | 
            
              | 370 |         return $c->render_resource_deleted; | 
            
              | 371 |     } catch { | 
            
              | 372 |         $c->unhandled_exception($_); | 
            
              | 373 |     }; | 
            
              | 374 | } | 
            
              | 375 |  | 
        
          | 166 | =head3 list_public | 376 | =head3 list_public | 
        
          | 167 |  | 377 |  | 
        
          | 168 | =cut | 378 | =cut | 
            
              | 169 | -  |  |  |