Lines 18-24
Link Here
|
18 |
use Modern::Perl; |
18 |
use Modern::Perl; |
19 |
|
19 |
|
20 |
use Test::NoWarnings; |
20 |
use Test::NoWarnings; |
21 |
use Test::More tests => 2; |
21 |
use Test::More tests => 6; |
22 |
use Test::Mojo; |
22 |
use Test::Mojo; |
23 |
|
23 |
|
24 |
use JSON qw(encode_json); |
24 |
use JSON qw(encode_json); |
Lines 52-124
subtest 'list_public() tests' => sub {
Link Here
|
52 |
$patron_2->set_password( { password => $password, skip_validation => 1 } ); |
52 |
$patron_2->set_password( { password => $password, skip_validation => 1 } ); |
53 |
my $patron_2_userid = $patron_2->userid; |
53 |
my $patron_2_userid = $patron_2->userid; |
54 |
|
54 |
|
55 |
my $list_1 = |
55 |
my $list_1 = $builder->build_object( |
56 |
$builder->build_object( { class => 'Koha::Virtualshelves', value => { owner => $patron_1->id, public => 1 } } ); |
|
|
57 |
my $list_2 = |
58 |
$builder->build_object( { class => 'Koha::Virtualshelves', value => { owner => $patron_1->id, public => 0 } } ); |
59 |
my $list_3 = |
60 |
$builder->build_object( { class => 'Koha::Virtualshelves', value => { owner => $patron_2->id, public => 1 } } ); |
61 |
my $list_4 = |
62 |
$builder->build_object( { class => 'Koha::Virtualshelves', value => { owner => $patron_2->id, public => 0 } } ); |
63 |
|
64 |
my $q = encode_json( |
65 |
{ |
56 |
{ |
66 |
list_id => { |
57 |
class => 'Koha::Virtualshelves', |
67 |
-in => [ |
58 |
value => { owner => $patron_1->id, public => 1 } |
68 |
$list_1->id, |
59 |
} |
69 |
$list_2->id, |
60 |
); |
70 |
$list_3->id, |
61 |
my $list_2 = $builder->build_object( |
71 |
$list_4->id, |
62 |
{ |
72 |
] |
63 |
class => 'Koha::Virtualshelves', |
73 |
} |
64 |
value => { owner => $patron_1->id, public => 0 } |
|
|
65 |
} |
66 |
); |
67 |
my $list_3 = $builder->build_object( |
68 |
{ |
69 |
class => 'Koha::Virtualshelves', |
70 |
value => { owner => $patron_2->id, public => 1 } |
71 |
} |
72 |
); |
73 |
my $list_4 = $builder->build_object( |
74 |
{ |
75 |
class => 'Koha::Virtualshelves', |
76 |
value => { owner => $patron_2->id, public => 0 } |
74 |
} |
77 |
} |
75 |
); |
78 |
); |
76 |
|
79 |
|
|
|
80 |
my $q = encode_json( { list_id => { -in => [ $list_1->id, $list_2->id, $list_3->id, $list_4->id, ] } } ); |
81 |
|
77 |
# anonymous |
82 |
# anonymous |
78 |
$t->get_ok("/api/v1/public/lists?q=$q")->status_is( 200, "Anonymous users can only fetch public lists" ) |
83 |
$t->get_ok("/api/v1/public/lists?q=$q")->status_is( 200, "Anonymous users can only fetch public lists" )->json_is( |
79 |
->json_is( [ $list_1->to_api( { public => 1 } ), $list_3->to_api( { public => 1 } ) ] ); |
84 |
[ |
|
|
85 |
$list_1->to_api( { public => 1 } ), |
86 |
$list_3->to_api( { public => 1 } ) |
87 |
] |
88 |
); |
80 |
|
89 |
|
81 |
$t->get_ok("/api/v1/public/lists?q=$q&only_public=1") |
90 |
$t->get_ok("/api/v1/public/lists?q=$q&only_public=1") |
82 |
->status_is( 200, "Anonymous users can only fetch public lists" ) |
91 |
->status_is( 200, "Anonymous users can only fetch public lists" )->json_is( |
83 |
->json_is( [ $list_1->to_api( { public => 1 } ), $list_3->to_api( { public => 1 } ) ] ); |
92 |
[ |
|
|
93 |
$list_1->to_api( { public => 1 } ), |
94 |
$list_3->to_api( { public => 1 } ) |
95 |
] |
96 |
); |
84 |
|
97 |
|
85 |
$t->get_ok("/api/v1/public/lists?q=$q&only_mine=1") |
98 |
$t->get_ok("/api/v1/public/lists?q=$q&only_mine=1")->status_is( |
86 |
->status_is( 400, "Passing only_mine on an anonymous session generates a 400 code" ) |
99 |
400, |
87 |
->json_is( '/error_code' => q{only_mine_forbidden} ); |
100 |
"Passing only_mine on an anonymous session generates a 400 code" |
|
|
101 |
)->json_is( '/error_code' => q{only_mine_forbidden} ); |
88 |
|
102 |
|
89 |
$t->get_ok("//$patron_1_userid:$password@/api/v1/public/lists?q=$q&only_mine=1") |
103 |
$t->get_ok("//$patron_1_userid:$password@/api/v1/public/lists?q=$q&only_mine=1")->status_is( |
90 |
->status_is( 200, "Passing only_mine with a logged in user makes it return only their lists" ) |
104 |
200, |
91 |
->json_is( [ $list_1->to_api( { public => 1 } ), $list_2->to_api( { public => 1 } ) ] ); |
105 |
"Passing only_mine with a logged in user makes it return only their lists" |
|
|
106 |
)->json_is( |
107 |
[ |
108 |
$list_1->to_api( { public => 1 } ), |
109 |
$list_2->to_api( { public => 1 } ) |
110 |
] |
111 |
); |
92 |
|
112 |
|
93 |
$t->get_ok("//$patron_2_userid:$password@/api/v1/public/lists?q=$q&only_mine=1") |
113 |
$t->get_ok("//$patron_2_userid:$password@/api/v1/public/lists?q=$q&only_mine=1")->status_is( |
94 |
->status_is( 200, "Passing only_mine with a logged in user makes it return only their lists" ) |
114 |
200, |
95 |
->json_is( [ $list_3->to_api( { public => 1 } ), $list_4->to_api( { public => 1 } ) ] ); |
115 |
"Passing only_mine with a logged in user makes it return only their lists" |
|
|
116 |
)->json_is( |
117 |
[ |
118 |
$list_3->to_api( { public => 1 } ), |
119 |
$list_4->to_api( { public => 1 } ) |
120 |
] |
121 |
); |
96 |
|
122 |
|
97 |
# only public |
123 |
# only public |
98 |
$t->get_ok("//$patron_1_userid:$password@/api/v1/public/lists?q=$q&only_public=1") |
124 |
$t->get_ok("//$patron_1_userid:$password@/api/v1/public/lists?q=$q&only_public=1")->status_is( |
99 |
->status_is( 200, "Passing only_public with a logged in user makes it return only public lists" ) |
125 |
200, |
100 |
->json_is( [ $list_1->to_api( { public => 1 } ), $list_3->to_api( { public => 1 } ) ] ); |
126 |
"Passing only_public with a logged in user makes it return only public lists" |
101 |
|
127 |
)->json_is( |
102 |
$t->get_ok("//$patron_2_userid:$password@/api/v1/public/lists?q=$q&only_public=1") |
128 |
[ |
103 |
->status_is( 200, "Passing only_public with a logged in user makes it return only public lists" ) |
129 |
$list_1->to_api( { public => 1 } ), |
104 |
->json_is( [ $list_1->to_api( { public => 1 } ), $list_3->to_api( { public => 1 } ) ] ); |
130 |
$list_3->to_api( { public => 1 } ) |
105 |
|
131 |
] |
106 |
$t->get_ok("//$patron_1_userid:$password@/api/v1/public/lists?q=$q") |
132 |
); |
107 |
->status_is( 200, "Not filtering with only_mine or only_public makes it return all accessible lists" ) |
133 |
|
108 |
->json_is( |
134 |
$t->get_ok("//$patron_2_userid:$password@/api/v1/public/lists?q=$q&only_public=1")->status_is( |
109 |
[ $list_1->to_api( { public => 1 } ), $list_2->to_api( { public => 1 } ), $list_3->to_api( { public => 1 } ) ] |
135 |
200, |
|
|
136 |
"Passing only_public with a logged in user makes it return only public lists" |
137 |
)->json_is( |
138 |
[ |
139 |
$list_1->to_api( { public => 1 } ), |
140 |
$list_3->to_api( { public => 1 } ) |
141 |
] |
142 |
); |
143 |
|
144 |
$t->get_ok("//$patron_1_userid:$password@/api/v1/public/lists?q=$q")->status_is( |
145 |
200, |
146 |
"Not filtering with only_mine or only_public makes it return all accessible lists" |
147 |
)->json_is( |
148 |
[ |
149 |
$list_1->to_api( { public => 1 } ), |
150 |
$list_2->to_api( { public => 1 } ), |
151 |
$list_3->to_api( { public => 1 } ) |
152 |
] |
153 |
); |
154 |
|
155 |
$t->get_ok("//$patron_2_userid:$password@/api/v1/public/lists?q=$q")->status_is( |
156 |
200, |
157 |
"Not filtering with only_mine or only_public makes it return all accessible lists" |
158 |
)->json_is( |
159 |
[ |
160 |
$list_1->to_api( { public => 1 } ), |
161 |
$list_3->to_api( { public => 1 } ), |
162 |
$list_4->to_api( { public => 1 } ) |
163 |
] |
164 |
); |
165 |
|
166 |
# conflicting params |
167 |
$t->get_ok("//$patron_1_userid:$password@/api/v1/public/lists?q=$q&only_public=1&only_mine=1")->status_is( |
168 |
200, |
169 |
"Passing only_public with a logged in user makes it return only public lists" |
170 |
)->json_is( [ $list_1->to_api( { public => 1 } ) ] ); |
171 |
|
172 |
$schema->storage->txn_rollback; |
173 |
}; |
174 |
|
175 |
subtest 'public_get() tests' => sub { |
176 |
plan tests => 12; |
177 |
|
178 |
$schema->storage->txn_begin; |
179 |
|
180 |
my $password = 'thePassword123'; |
181 |
my $patron_1 = $builder->build_object( { class => 'Koha::Patrons' } ); |
182 |
my $patron_2 = $builder->build_object( { class => 'Koha::Patrons' } ); |
183 |
|
184 |
$patron_1->set_password( { password => $password, skip_validation => 1 } ); |
185 |
$patron_2->set_password( { password => $password, skip_validation => 1 } ); |
186 |
|
187 |
my $patron_1_userid = $patron_1->userid; |
188 |
my $patron_2_userid = $patron_2->userid; |
189 |
|
190 |
# Create test lists |
191 |
my $public_list = $builder->build_object( |
192 |
{ |
193 |
class => 'Koha::Virtualshelves', |
194 |
value => { |
195 |
owner => $patron_1->id, |
196 |
public => 1, |
197 |
allow_change_from_owner => 1 |
198 |
} |
199 |
} |
200 |
); |
201 |
|
202 |
my $private_list = $builder->build_object( |
203 |
{ |
204 |
class => 'Koha::Virtualshelves', |
205 |
value => { |
206 |
owner => $patron_1->id, |
207 |
public => 0, |
208 |
allow_change_from_owner => 0 |
209 |
} |
210 |
} |
211 |
); |
212 |
|
213 |
# Test anonymous access to public list |
214 |
$t->get_ok( "/api/v1/public/lists/" . $public_list->id )->status_is(200)->json_is( $public_list->to_api ); |
215 |
|
216 |
# Test anonymous access to private list |
217 |
$t->get_ok( "/api/v1/public/lists/" . $private_list->id ) |
218 |
->status_is( 403, 'Anonymous user cannot access private list' ); |
219 |
|
220 |
# Test authenticated access - owner can see their private list |
221 |
$t->get_ok( "//$patron_1_userid:$password@/api/v1/public/lists/" . $private_list->id )->status_is(200) |
222 |
->json_is( $private_list->to_api ); |
223 |
|
224 |
# Test non-owner access to private list |
225 |
$t->get_ok( "//$patron_2_userid:$password@/api/v1/public/lists/" . $private_list->id ) |
226 |
->status_is( 403, 'Non-owner cannot access private list' ); |
227 |
|
228 |
# Test non-existent list |
229 |
$t->get_ok("/api/v1/public/lists/99999999")->status_is( 404, "List not found" ); |
230 |
|
231 |
$schema->storage->txn_rollback; |
232 |
}; |
233 |
|
234 |
subtest 'public_add() tests' => sub { |
235 |
plan tests => 9; # Reduced test count since we're removing one assertion |
236 |
|
237 |
$schema->storage->txn_begin; |
238 |
|
239 |
my $password = 'thePassword123'; |
240 |
my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
241 |
my $another_patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
242 |
$patron->set_password( { password => $password, skip_validation => 1 } ); |
243 |
my $patron_userid = $patron->userid; |
244 |
|
245 |
my $list_data = { |
246 |
name => "Test List", |
247 |
public => 1, |
248 |
allow_change_from_owner => 1, |
249 |
allow_change_from_others => 0, |
250 |
default_sort_field => 'title' |
251 |
}; |
252 |
|
253 |
# Test anonymous attempt |
254 |
$t->post_ok( "/api/v1/public/lists" => json => $list_data )->status_is( 401, 'Anonymous user cannot create list' ); |
255 |
|
256 |
# Test authenticated user can create list |
257 |
$t->post_ok( "//$patron_userid:$password@/api/v1/public/lists" => json => $list_data )->status_is(201) |
258 |
->json_has( '/list_id', 'List ID is present in response' ) |
259 |
->json_has( '/name', 'List name is present in response' )->json_is( |
260 |
'/owner_id' => $patron->id, |
261 |
'List created with logged in user as owner' |
110 |
); |
262 |
); |
111 |
|
263 |
|
112 |
$t->get_ok("//$patron_2_userid:$password@/api/v1/public/lists?q=$q") |
264 |
# Test attempt to specify owner_id |
113 |
->status_is( 200, "Not filtering with only_mine or only_public makes it return all accessible lists" ) |
265 |
my $list_with_owner = { |
114 |
->json_is( |
266 |
name => "Test List", |
115 |
[ $list_1->to_api( { public => 1 } ), $list_3->to_api( { public => 1 } ), $list_4->to_api( { public => 1 } ) ] |
267 |
owner_id => $another_patron->id, # Should be rejected |
|
|
268 |
public => 1, |
269 |
allow_change_from_owner => 1, |
270 |
allow_change_from_others => 0, |
271 |
default_sort_field => 'title' |
272 |
}; |
273 |
|
274 |
$t->post_ok( "//$patron_userid:$password@/api/v1/public/lists" => json => $list_with_owner )->status_is(400); |
275 |
|
276 |
$schema->storage->txn_rollback; |
277 |
}; |
278 |
|
279 |
subtest 'public_update() tests' => sub { |
280 |
plan tests => 15; |
281 |
|
282 |
$schema->storage->txn_begin; |
283 |
|
284 |
my $password = 'thePassword123'; |
285 |
my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
286 |
my $another_patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
287 |
|
288 |
$patron->set_password( { password => $password, skip_validation => 1 } ); |
289 |
$another_patron->set_password( { password => $password, skip_validation => 1 } ); |
290 |
|
291 |
my $patron_userid = $patron->userid; |
292 |
my $another_patron_userid = $another_patron->userid; |
293 |
|
294 |
# Create a list that can be modified |
295 |
my $modifiable_list = $builder->build_object( |
296 |
{ |
297 |
class => 'Koha::Virtualshelves', |
298 |
value => { |
299 |
owner => $patron->id, |
300 |
public => 1, |
301 |
allow_change_from_owner => 1 |
302 |
} |
303 |
} |
304 |
); |
305 |
|
306 |
# Create a list that cannot be modified |
307 |
my $unmodifiable_list = $builder->build_object( |
308 |
{ |
309 |
class => 'Koha::Virtualshelves', |
310 |
value => { |
311 |
owner => $patron->id, |
312 |
public => 1, |
313 |
allow_change_from_owner => 0 |
314 |
} |
315 |
} |
316 |
); |
317 |
|
318 |
my $update_data = { |
319 |
name => "Updated List Name", |
320 |
public => 0, |
321 |
allow_change_from_owner => 1, |
322 |
allow_change_from_others => 0, |
323 |
default_sort_field => 'title' |
324 |
}; |
325 |
|
326 |
# Test anonymous attempt |
327 |
$t->put_ok( "/api/v1/public/lists/" . $modifiable_list->id => json => $update_data ) |
328 |
->status_is( 401, 'Anonymous user cannot update list' ); |
329 |
|
330 |
# Test non-owner update attempt |
331 |
$t->put_ok( |
332 |
"//$another_patron_userid:$password@/api/v1/public/lists/" . $modifiable_list->id => json => $update_data ) |
333 |
->status_is( 403, 'Non-owner cannot update list' ); |
334 |
|
335 |
# Test owner update success |
336 |
$t->put_ok( "//$patron_userid:$password@/api/v1/public/lists/" . $modifiable_list->id => json => $update_data ) |
337 |
->status_is(200)->json_is( '/name' => 'Updated List Name', 'List name updated' ) |
338 |
->json_is( '/public' => 0, 'List privacy updated' ); |
339 |
|
340 |
# Test update of non-existent list |
341 |
$t->put_ok( "//$patron_userid:$password@/api/v1/public/lists/99999999" => json => $update_data ) |
342 |
->status_is( 404, "List not found" ); |
343 |
|
344 |
# Test update of unmodifiable list |
345 |
$t->put_ok( "//$patron_userid:$password@/api/v1/public/lists/" . $unmodifiable_list->id => json => $update_data ) |
346 |
->status_is( |
347 |
403, |
348 |
"Cannot update list when allow_change_from_owner is false" |
349 |
)->json_is( '/error_code' => 'forbidden', 'Correct error code returned' ); |
350 |
|
351 |
# Create librarian with necessary permissions |
352 |
my $librarian = $builder->build_object( |
353 |
{ |
354 |
class => 'Koha::Patrons', |
355 |
value => { flags => 2**13 } |
356 |
} |
357 |
); |
358 |
$librarian->set_password( { password => $password, skip_validation => 1 } ); |
359 |
my $librarian_userid = $librarian->userid; |
360 |
|
361 |
# Test librarian using public endpoint |
362 |
$t->put_ok( "//$librarian_userid:$password@/api/v1/public/lists/" . $modifiable_list->id => json => $update_data ) |
363 |
->status_is( |
364 |
403, |
365 |
'Librarian must use admin endpoint to modify others lists' |
116 |
); |
366 |
); |
117 |
|
367 |
|
118 |
# conflicting params |
368 |
$schema->storage->txn_rollback; |
119 |
$t->get_ok("//$patron_1_userid:$password@/api/v1/public/lists?q=$q&only_public=1&only_mine=1") |
369 |
}; |
120 |
->status_is( 200, "Passing only_public with a logged in user makes it return only public lists" ) |
370 |
|
121 |
->json_is( [ $list_1->to_api( { public => 1 } ) ] ); |
371 |
subtest 'public_delete() tests' => sub { |
|
|
372 |
plan tests => 12; |
373 |
|
374 |
$schema->storage->txn_begin; |
375 |
|
376 |
my $password = 'thePassword123'; |
377 |
my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
378 |
my $another_patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
379 |
|
380 |
$patron->set_password( { password => $password, skip_validation => 1 } ); |
381 |
$another_patron->set_password( { password => $password, skip_validation => 1 } ); |
382 |
|
383 |
my $patron_userid = $patron->userid; |
384 |
my $another_patron_userid = $another_patron->userid; |
385 |
|
386 |
# Create test lists for different scenarios |
387 |
my $modifiable_list = $builder->build_object( |
388 |
{ |
389 |
class => 'Koha::Virtualshelves', |
390 |
value => { |
391 |
owner => $patron->id, |
392 |
public => 1, |
393 |
allow_change_from_owner => 1 |
394 |
} |
395 |
} |
396 |
); |
397 |
|
398 |
my $other_patron_list = $builder->build_object( |
399 |
{ |
400 |
class => 'Koha::Virtualshelves', |
401 |
value => { |
402 |
owner => $another_patron->id, |
403 |
public => 1, |
404 |
allow_change_from_owner => 1 |
405 |
} |
406 |
} |
407 |
); |
408 |
|
409 |
my $unmodifiable_list = $builder->build_object( |
410 |
{ |
411 |
class => 'Koha::Virtualshelves', |
412 |
value => { |
413 |
owner => $patron->id, |
414 |
public => 1, |
415 |
allow_change_from_owner => 0 |
416 |
} |
417 |
} |
418 |
); |
419 |
|
420 |
# Test anonymous attempt |
421 |
$t->delete_ok( "/api/v1/public/lists/" . $modifiable_list->id ) |
422 |
->status_is( 401, 'Anonymous user cannot delete list' ); |
423 |
|
424 |
# Test non-owner delete attempt |
425 |
$t->delete_ok( "//$another_patron_userid:$password@/api/v1/public/lists/" . $modifiable_list->id ) |
426 |
->status_is( 403, 'Non-owner cannot delete list' ); |
427 |
|
428 |
# Test attempt to delete another patron's list |
429 |
$t->delete_ok( "//$patron_userid:$password@/api/v1/public/lists/" . $other_patron_list->id ) |
430 |
->status_is( 403, "Cannot delete another patron's list" ); |
431 |
|
432 |
# Test delete of unmodifiable list |
433 |
$t->delete_ok( "//$patron_userid:$password@/api/v1/public/lists/" . $unmodifiable_list->id )->status_is( |
434 |
403, |
435 |
"Cannot delete list when allow_change_from_owner is false" |
436 |
); |
437 |
|
438 |
# Test delete of non-existent list |
439 |
$t->delete_ok("//$patron_userid:$password@/api/v1/public/lists/99999999")->status_is( 404, "List not found" ); |
440 |
|
441 |
# Test successful delete by owner |
442 |
$t->delete_ok( "//$patron_userid:$password@/api/v1/public/lists/" . $modifiable_list->id ) |
443 |
->status_is( 204, 'List deleted successfully' ); |
122 |
|
444 |
|
123 |
$schema->storage->txn_rollback; |
445 |
$schema->storage->txn_rollback; |
124 |
}; |
446 |
}; |
125 |
- |
447 |
|
|
|
448 |
1; |