View | Details | Raw Unified | Return to bug 28907
Collapse All | Expand All

(-)a/Koha/REST/V1/Patrons.pm (+4 lines)
Lines 456-461 sub guarantors_can_see_charges { Link Here
456
    my $c = shift->openapi->valid_input or return;
456
    my $c = shift->openapi->valid_input or return;
457
457
458
    return try {
458
    return try {
459
        $c->auth->public( $c->param('patron_id') );
460
459
        if ( C4::Context->preference('AllowPatronToSetFinesVisibilityForGuarantor') ) {
461
        if ( C4::Context->preference('AllowPatronToSetFinesVisibilityForGuarantor') ) {
460
            my $patron = $c->stash( 'koha.user' );
462
            my $patron = $c->stash( 'koha.user' );
461
            my $privacy_setting = ($c->req->json->{allowed}) ? 1 : 0;
463
            my $privacy_setting = ($c->req->json->{allowed}) ? 1 : 0;
Lines 492-497 sub guarantors_can_see_checkouts { Link Here
492
    my $c = shift->openapi->valid_input or return;
494
    my $c = shift->openapi->valid_input or return;
493
495
494
    return try {
496
    return try {
497
        $c->auth->public( $c->param('patron_id') );
498
495
        if ( C4::Context->preference('AllowPatronToSetCheckoutsVisibilityForGuarantor') ) {
499
        if ( C4::Context->preference('AllowPatronToSetCheckoutsVisibilityForGuarantor') ) {
496
            my $patron = $c->stash( 'koha.user' );
500
            my $patron = $c->stash( 'koha.user' );
497
            my $privacy_setting = ( $c->req->json->{allowed} ) ? 1 : 0;
501
            my $privacy_setting = ( $c->req->json->{allowed} ) ? 1 : 0;
(-)a/api/v1/swagger/paths/public_patrons.yaml (-4 lines)
Lines 182-189 Link Here
182
        description: Under maintenance
182
        description: Under maintenance
183
        schema:
183
        schema:
184
          $ref: "../swagger.yaml#/definitions/error"
184
          $ref: "../swagger.yaml#/definitions/error"
185
    x-koha-authorization:
186
      allow-owner: true
187
"/public/patrons/{patron_id}/guarantors/can_see_checkouts":
185
"/public/patrons/{patron_id}/guarantors/can_see_checkouts":
188
  put:
186
  put:
189
    x-mojo-to: Patrons#guarantors_can_see_checkouts
187
    x-mojo-to: Patrons#guarantors_can_see_checkouts
Lines 236-243 Link Here
236
        description: Under maintenance
234
        description: Under maintenance
237
        schema:
235
        schema:
238
          $ref: "../swagger.yaml#/definitions/error"
236
          $ref: "../swagger.yaml#/definitions/error"
239
    x-koha-authorization:
240
      allow-owner: true
241
"/public/patrons/{patron_id}/holds/{hold_id}":
237
"/public/patrons/{patron_id}/holds/{hold_id}":
242
  delete:
238
  delete:
243
    x-mojo-to: Patrons::Holds#delete_public
239
    x-mojo-to: Patrons::Holds#delete_public
(-)a/t/db_dependent/api/v1/patrons.t (-3 / +19 lines)
Lines 1140-1146 subtest 'delete() tests' => sub { Link Here
1140
1140
1141
subtest 'guarantors_can_see_charges() tests' => sub {
1141
subtest 'guarantors_can_see_charges() tests' => sub {
1142
1142
1143
    plan tests => 11;
1143
    plan tests => 17;
1144
1144
1145
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
1145
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
1146
    t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
1146
    t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
Lines 1148-1153 subtest 'guarantors_can_see_charges() tests' => sub { Link Here
1148
    $schema->storage->txn_begin;
1148
    $schema->storage->txn_begin;
1149
1149
1150
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { privacy_guarantor_fines => 0 } });
1150
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { privacy_guarantor_fines => 0 } });
1151
    my $other_patron_id = $builder->build_object( { class => 'Koha::Patrons' } )->borrowernumber;
1151
    my $password = 'thePassword123';
1152
    my $password = 'thePassword123';
1152
    $patron->set_password({ password => $password, skip_validation => 1 });
1153
    $patron->set_password({ password => $password, skip_validation => 1 });
1153
    my $userid = $patron->userid;
1154
    my $userid = $patron->userid;
Lines 1155-1160 subtest 'guarantors_can_see_charges() tests' => sub { Link Here
1155
1156
1156
    t::lib::Mocks::mock_preference( 'AllowPatronToSetFinesVisibilityForGuarantor', 0 );
1157
    t::lib::Mocks::mock_preference( 'AllowPatronToSetFinesVisibilityForGuarantor', 0 );
1157
1158
1159
    $t->put_ok(
1160
        "/api/v1/public/patrons/$other_patron_id/guarantors/can_see_charges" => json => { allowed => Mojo::JSON->true }
1161
    )->status_is(401)->json_is( { error => "Authentication failure." } );
1162
1163
    $t->put_ok( "//$userid:$password@/api/v1/public/patrons/$other_patron_id/guarantors/can_see_charges" => json =>
1164
            { allowed => Mojo::JSON->true } )->status_is(403)
1165
        ->json_is( { error => "Unprivileged user cannot access another user's resources" } );
1166
1158
    $t->put_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/guarantors/can_see_charges" => json => { allowed => Mojo::JSON->true } )
1167
    $t->put_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/guarantors/can_see_charges" => json => { allowed => Mojo::JSON->true } )
1159
      ->status_is( 403 )
1168
      ->status_is( 403 )
1160
      ->json_is( '/error', 'The current configuration doesn\'t allow the requested action.' );
1169
      ->json_is( '/error', 'The current configuration doesn\'t allow the requested action.' );
Lines 1178-1184 subtest 'guarantors_can_see_charges() tests' => sub { Link Here
1178
1187
1179
subtest 'guarantors_can_see_checkouts() tests' => sub {
1188
subtest 'guarantors_can_see_checkouts() tests' => sub {
1180
1189
1181
    plan tests => 11;
1190
    plan tests => 17;
1182
1191
1183
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
1192
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
1184
    t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
1193
    t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
Lines 1186-1196 subtest 'guarantors_can_see_checkouts() tests' => sub { Link Here
1186
    $schema->storage->txn_begin;
1195
    $schema->storage->txn_begin;
1187
1196
1188
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { privacy_guarantor_checkouts => 0 } });
1197
    my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { privacy_guarantor_checkouts => 0 } });
1198
    my $other_patron_id = $builder->build_object( { class => 'Koha::Patrons' } )->borrowernumber;
1189
    my $password = 'thePassword123';
1199
    my $password = 'thePassword123';
1190
    $patron->set_password({ password => $password, skip_validation => 1 });
1200
    $patron->set_password({ password => $password, skip_validation => 1 });
1191
    my $userid = $patron->userid;
1201
    my $userid = $patron->userid;
1192
    my $patron_id = $patron->borrowernumber;
1202
    my $patron_id = $patron->borrowernumber;
1193
1203
1204
    $t->put_ok( "/api/v1/public/patrons/$other_patron_id/guarantors/can_see_checkouts" => json =>
1205
            { allowed => Mojo::JSON->true } )->status_is(401)->json_is( { error => "Authentication failure." } );
1206
1207
    $t->put_ok( "//$userid:$password@/api/v1/public/patrons/$other_patron_id/guarantors/can_see_checkouts" => json =>
1208
            { allowed => Mojo::JSON->true } )->status_is(403)
1209
        ->json_is( { error => "Unprivileged user cannot access another user's resources" } );
1210
1194
    t::lib::Mocks::mock_preference( 'AllowPatronToSetCheckoutsVisibilityForGuarantor', 0 );
1211
    t::lib::Mocks::mock_preference( 'AllowPatronToSetCheckoutsVisibilityForGuarantor', 0 );
1195
1212
1196
    $t->put_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/guarantors/can_see_checkouts" => json => { allowed => Mojo::JSON->true } )
1213
    $t->put_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/guarantors/can_see_checkouts" => json => { allowed => Mojo::JSON->true } )
1197
- 

Return to bug 28907