| Lines 162-167
          sub delete {
      
      
        Link Here | 
        
          | 162 |     ); | 162 |     ); | 
        
          | 163 | } | 163 | } | 
        
          | 164 |  | 164 |  | 
            
              |  |  | 165 | =head3 public_add | 
            
              | 166 |  | 
            
              | 167 | Create a public virtual shelf | 
            
              | 168 |  | 
            
              | 169 | =cut | 
            
              | 170 |  | 
            
              | 171 | sub public_add { | 
            
              | 172 |     my $c = shift->openapi->valid_input or return; | 
            
              | 173 |  | 
            
              | 174 |     my $user = $c->stash('koha.user'); | 
            
              | 175 |  | 
            
              | 176 |     # Handle anonymous users first | 
            
              | 177 |     unless ($user) { | 
            
              | 178 |         return $c->render( | 
            
              | 179 |             status  => 401, | 
            
              | 180 |             openapi => { | 
            
              | 181 |                 error      => "Authentication required", | 
            
              | 182 |                 error_code => "authentication_required" | 
            
              | 183 |             } | 
            
              | 184 |         ); | 
            
              | 185 |     } | 
            
              | 186 |  | 
            
              | 187 |     my $body = $c->req->json; | 
            
              | 188 |     $body->{owner} = $user->id; | 
            
              | 189 |  | 
            
              | 190 |     return try { | 
            
              | 191 |         my $list = Koha::Virtualshelf->new_from_api($body); | 
            
              | 192 |         $list->store->discard_changes; | 
            
              | 193 |  | 
            
              | 194 |         $c->res->headers->location( $c->req->url->to_string . '/' . $list->id ); | 
            
              | 195 |  | 
            
              | 196 |         return $c->render( | 
            
              | 197 |             status  => 201, | 
            
              | 198 |             openapi => $list->to_api | 
            
              | 199 |         ); | 
            
              | 200 |     } catch { | 
            
              | 201 |         $c->unhandled_exception($_); | 
            
              | 202 |     }; | 
            
              | 203 | } | 
            
              | 204 |  | 
            
              | 205 | =head3 public_get | 
            
              | 206 |  | 
            
              | 207 | List the contents of a public virtual shelf or a virtual shelf you own | 
            
              | 208 |  | 
            
              | 209 | =cut | 
            
              | 210 |  | 
            
              | 211 | sub public_get { | 
            
              | 212 |     my $c = shift->openapi->valid_input or return; | 
            
              | 213 |  | 
            
              | 214 |     return try { | 
            
              | 215 |         my $list = Koha::Virtualshelves->find( $c->param('list_id') ); | 
            
              | 216 |  | 
            
              | 217 |         return $c->render_resource_not_found("List") | 
            
              | 218 |             unless $list; | 
            
              | 219 |  | 
            
              | 220 |         my $user = $c->stash('koha.user'); | 
            
              | 221 |  | 
            
              | 222 |         # If no user is logged in, only allow access to public lists | 
            
              | 223 |         unless ($user) { | 
            
              | 224 |             return $c->render( | 
            
              | 225 |                 status  => 403, | 
            
              | 226 |                 openapi => { | 
            
              | 227 |                     error      => "Forbidden - anonymous users can only view public lists", | 
            
              | 228 |                     error_code => "forbidden" | 
            
              | 229 |                 } | 
            
              | 230 |             ) unless $list->public; | 
            
              | 231 |  | 
            
              | 232 |             return $c->render( | 
            
              | 233 |                 status  => 200, | 
            
              | 234 |                 openapi => $list->to_api | 
            
              | 235 |             ); | 
            
              | 236 |         } | 
            
              | 237 |  | 
            
              | 238 |         # For logged in users, check ownership and public status | 
            
              | 239 |         unless ( $list->owner == $user->id || $list->public == 1 ) { | 
            
              | 240 |             return $c->render( | 
            
              | 241 |                 status  => 403, | 
            
              | 242 |                 openapi => { | 
            
              | 243 |                     error      => "Forbidden - you can only view your own lists or public lists", | 
            
              | 244 |                     error_code => "forbidden" | 
            
              | 245 |                 } | 
            
              | 246 |             ); | 
            
              | 247 |         } | 
            
              | 248 |  | 
            
              | 249 |         return $c->render( | 
            
              | 250 |             status  => 200, | 
            
              | 251 |             openapi => $list->to_api | 
            
              | 252 |         ); | 
            
              | 253 |     } catch { | 
            
              | 254 |         $c->unhandled_exception($_); | 
            
              | 255 |     }; | 
            
              | 256 | } | 
            
              | 257 |  | 
            
              | 258 | =head3 public_update | 
            
              | 259 |  | 
            
              | 260 | Update a public virtual shelf or a shelf you own | 
            
              | 261 |  | 
            
              | 262 | =cut | 
            
              | 263 |  | 
            
              | 264 | sub public_update { | 
            
              | 265 |     my $c = shift->openapi->valid_input or return; | 
            
              | 266 |  | 
            
              | 267 |     my $user = $c->stash('koha.user'); | 
            
              | 268 |  | 
            
              | 269 |     # Handle anonymous users first | 
            
              | 270 |     unless ($user) { | 
            
              | 271 |         return $c->render( | 
            
              | 272 |             status  => 401, | 
            
              | 273 |             openapi => { | 
            
              | 274 |                 error      => "Authentication required", | 
            
              | 275 |                 error_code => "authentication_required" | 
            
              | 276 |             } | 
            
              | 277 |         ); | 
            
              | 278 |     } | 
            
              | 279 |  | 
            
              | 280 |     my $list = Koha::Virtualshelves->find( $c->param('list_id') ); | 
            
              | 281 |  | 
            
              | 282 |     return $c->render_resource_not_found("List") | 
            
              | 283 |         unless $list; | 
            
              | 284 |  | 
            
              | 285 |     if ( $list->owner != $user->id ) { | 
            
              | 286 |         return $c->render( | 
            
              | 287 |             status  => 403, | 
            
              | 288 |             openapi => { | 
            
              | 289 |                 error      => "Forbidden - you can only update your own lists", | 
            
              | 290 |                 error_code => "forbidden" | 
            
              | 291 |             } | 
            
              | 292 |         ); | 
            
              | 293 |     } | 
            
              | 294 |  | 
            
              | 295 |     if ( $list->allow_change_from_owner == 0 ) { | 
            
              | 296 |         return $c->render( | 
            
              | 297 |             status  => 403, | 
            
              | 298 |             openapi => { | 
            
              | 299 |                 error      => "Forbidden - you can't update this list", | 
            
              | 300 |                 error_code => "forbidden" | 
            
              | 301 |             } | 
            
              | 302 |         ); | 
            
              | 303 |     } | 
            
              | 304 |  | 
            
              | 305 |     return try { | 
            
              | 306 |         $list->set_from_api( $c->req->json ); | 
            
              | 307 |         $list->store(); | 
            
              | 308 |  | 
            
              | 309 |         return $c->render( | 
            
              | 310 |             status  => 200, | 
            
              | 311 |             openapi => $list->to_api | 
            
              | 312 |         ); | 
            
              | 313 |     } catch { | 
            
              | 314 |         $c->unhandled_exception($_); | 
            
              | 315 |     }; | 
            
              | 316 | } | 
            
              | 317 |  | 
            
              | 318 | =head3 public_delete | 
            
              | 319 |  | 
            
              | 320 | Delete a public virtual shelf you own | 
            
              | 321 |  | 
            
              | 322 | =cut | 
            
              | 323 |  | 
            
              | 324 | sub public_delete { | 
            
              | 325 |     my $c = shift->openapi->valid_input or return; | 
            
              | 326 |  | 
            
              | 327 |     my $user = $c->stash('koha.user'); | 
            
              | 328 |  | 
            
              | 329 |     # Handle anonymous users first | 
            
              | 330 |     unless ($user) { | 
            
              | 331 |         return $c->render( | 
            
              | 332 |             status  => 401, | 
            
              | 333 |             openapi => { | 
            
              | 334 |                 error      => "Authentication required", | 
            
              | 335 |                 error_code => "authentication_required" | 
            
              | 336 |             } | 
            
              | 337 |         ); | 
            
              | 338 |     } | 
            
              | 339 |  | 
            
              | 340 |     my $list = Koha::Virtualshelves->find( $c->param('list_id') ); | 
            
              | 341 |  | 
            
              | 342 |     return $c->render_resource_not_found("List") | 
            
              | 343 |         unless $list; | 
            
              | 344 |  | 
            
              | 345 |     # Check ownership | 
            
              | 346 |     if ( $list->owner != $user->id ) { | 
            
              | 347 |         return $c->render( | 
            
              | 348 |             status  => 403, | 
            
              | 349 |             openapi => { | 
            
              | 350 |                 error      => "Forbidden - you can only delete your own lists", | 
            
              | 351 |                 error_code => "forbidden" | 
            
              | 352 |             } | 
            
              | 353 |         ); | 
            
              | 354 |     } | 
            
              | 355 |  | 
            
              | 356 |     # Check if modifications allowed | 
            
              | 357 |     if ( $list->allow_change_from_owner == 0 ) { | 
            
              | 358 |         return $c->render( | 
            
              | 359 |             status  => 403, | 
            
              | 360 |             openapi => { | 
            
              | 361 |                 error      => "Forbidden - you can't delete this list", | 
            
              | 362 |                 error_code => "forbidden" | 
            
              | 363 |             } | 
            
              | 364 |         ); | 
            
              | 365 |     } | 
            
              | 366 |  | 
            
              | 367 |     return try { | 
            
              | 368 |         $list->delete; | 
            
              | 369 |         return $c->render_resource_deleted; | 
            
              | 370 |     } catch { | 
            
              | 371 |         $c->unhandled_exception($_); | 
            
              | 372 |     }; | 
            
              | 373 | } | 
            
              | 374 |  | 
        
          | 165 | =head3 list_public | 375 | =head3 list_public | 
        
          | 166 |  | 376 |  | 
        
          | 167 | =cut | 377 | =cut | 
            
              | 168 | -  |  |  |