View | Details | Raw Unified | Return to bug 38050
Collapse All | Expand All

(-)a/Koha/REST/V1/Lists.pm (-1 / +210 lines)
Lines 162-167 sub delete { Link Here
162
    );
162
    );
163
}
163
}
164
164
165
=head3 public_add
166
167
Create a public virtual shelf
168
169
=cut
170
171
sub public_add {
172
    my $c = shift->openapi->valid_input or return;
173
174
    my $user = $c->stash('koha.user');
175
176
    # Handle anonymous users first
177
    unless ($user) {
178
        return $c->render(
179
            status  => 401,
180
            openapi => {
181
                error      => "Authentication required",
182
                error_code => "authentication_required"
183
            }
184
        );
185
    }
186
187
    my $body = $c->req->json;
188
    $body->{owner} = $user->id;
189
190
    return try {
191
        my $list = Koha::Virtualshelf->new_from_api($body);
192
        $list->store->discard_changes;
193
194
        $c->res->headers->location( $c->req->url->to_string . '/' . $list->id );
195
196
        return $c->render(
197
            status  => 201,
198
            openapi => $list->to_api
199
        );
200
    } catch {
201
        $c->unhandled_exception($_);
202
    };
203
}
204
205
=head3 public_get
206
207
List the contents of a public virtual shelf or a virtual shelf you own
208
209
=cut
210
211
sub public_get {
212
    my $c = shift->openapi->valid_input or return;
213
214
    return try {
215
        my $list = Koha::Virtualshelves->find( $c->param('list_id') );
216
217
        return $c->render_resource_not_found("List")
218
            unless $list;
219
220
        my $user = $c->stash('koha.user');
221
222
        # If no user is logged in, only allow access to public lists
223
        unless ($user) {
224
            return $c->render(
225
                status  => 403,
226
                openapi => {
227
                    error      => "Forbidden - anonymous users can only view public lists",
228
                    error_code => "forbidden"
229
                }
230
            ) unless $list->public;
231
232
            return $c->render(
233
                status  => 200,
234
                openapi => $list->to_api
235
            );
236
        }
237
238
        # For logged in users, check ownership and public status
239
        unless ( $list->owner == $user->id || $list->public == 1 ) {
240
            return $c->render(
241
                status  => 403,
242
                openapi => {
243
                    error      => "Forbidden - you can only view your own lists or public lists",
244
                    error_code => "forbidden"
245
                }
246
            );
247
        }
248
249
        return $c->render(
250
            status  => 200,
251
            openapi => $list->to_api
252
        );
253
    } catch {
254
        $c->unhandled_exception($_);
255
    };
256
}
257
258
=head3 public_update
259
260
Update a public virtual shelf or a shelf you own
261
262
=cut
263
264
sub public_update {
265
    my $c = shift->openapi->valid_input or return;
266
267
    my $user = $c->stash('koha.user');
268
269
    # Handle anonymous users first
270
    unless ($user) {
271
        return $c->render(
272
            status  => 401,
273
            openapi => {
274
                error      => "Authentication required",
275
                error_code => "authentication_required"
276
            }
277
        );
278
    }
279
280
    my $list = Koha::Virtualshelves->find( $c->param('list_id') );
281
282
    return $c->render_resource_not_found("List")
283
        unless $list;
284
285
    if ( $list->owner != $user->id ) {
286
        return $c->render(
287
            status  => 403,
288
            openapi => {
289
                error      => "Forbidden - you can only update your own lists",
290
                error_code => "forbidden"
291
            }
292
        );
293
    }
294
295
    if ( $list->allow_change_from_owner == 0 ) {
296
        return $c->render(
297
            status  => 403,
298
            openapi => {
299
                error      => "Forbidden - you can't update this list",
300
                error_code => "forbidden"
301
            }
302
        );
303
    }
304
305
    return try {
306
        $list->set_from_api( $c->req->json );
307
        $list->store();
308
309
        return $c->render(
310
            status  => 200,
311
            openapi => $list->to_api
312
        );
313
    } catch {
314
        $c->unhandled_exception($_);
315
    };
316
}
317
318
=head3 public_delete
319
320
Delete a public virtual shelf you own
321
322
=cut
323
324
sub public_delete {
325
    my $c = shift->openapi->valid_input or return;
326
327
    my $user = $c->stash('koha.user');
328
329
    # Handle anonymous users first
330
    unless ($user) {
331
        return $c->render(
332
            status  => 401,
333
            openapi => {
334
                error      => "Authentication required",
335
                error_code => "authentication_required"
336
            }
337
        );
338
    }
339
340
    my $list = Koha::Virtualshelves->find( $c->param('list_id') );
341
342
    return $c->render_resource_not_found("List")
343
        unless $list;
344
345
    # Check ownership
346
    if ( $list->owner != $user->id ) {
347
        return $c->render(
348
            status  => 403,
349
            openapi => {
350
                error      => "Forbidden - you can only delete your own lists",
351
                error_code => "forbidden"
352
            }
353
        );
354
    }
355
356
    # Check if modifications allowed
357
    if ( $list->allow_change_from_owner == 0 ) {
358
        return $c->render(
359
            status  => 403,
360
            openapi => {
361
                error      => "Forbidden - you can't delete this list",
362
                error_code => "forbidden"
363
            }
364
        );
365
    }
366
367
    return try {
368
        $list->delete;
369
        return $c->render_resource_deleted;
370
    } catch {
371
        $c->unhandled_exception($_);
372
    };
373
}
374
165
=head3 list_public
375
=head3 list_public
166
376
167
=cut
377
=cut
168
- 

Return to bug 38050