Lines 162-167
sub delete {
Link Here
|
162 |
); |
162 |
); |
163 |
} |
163 |
} |
164 |
|
164 |
|
|
|
165 |
=head3 public_add |
166 |
|
167 |
Create a public virtual shelf |
168 |
|
169 |
=cut |
170 |
|
171 |
sub public_add { |
172 |
my $c = shift->openapi->valid_input or return; |
173 |
|
174 |
my $user = $c->stash('koha.user'); |
175 |
|
176 |
# Handle anonymous users first |
177 |
unless ($user) { |
178 |
return $c->render( |
179 |
status => 401, |
180 |
openapi => { |
181 |
error => "Authentication required", |
182 |
error_code => "authentication_required" |
183 |
} |
184 |
); |
185 |
} |
186 |
|
187 |
my $body = $c->req->json; |
188 |
$body->{owner} = $user->id; |
189 |
|
190 |
return try { |
191 |
my $list = Koha::Virtualshelf->new_from_api($body); |
192 |
$list->store->discard_changes; |
193 |
|
194 |
$c->res->headers->location( $c->req->url->to_string . '/' . $list->id ); |
195 |
|
196 |
return $c->render( |
197 |
status => 201, |
198 |
openapi => $list->to_api |
199 |
); |
200 |
} catch { |
201 |
$c->unhandled_exception($_); |
202 |
}; |
203 |
} |
204 |
|
205 |
=head3 public_get |
206 |
|
207 |
List the contents of a public virtual shelf or a virtual shelf you own |
208 |
|
209 |
=cut |
210 |
|
211 |
sub public_get { |
212 |
my $c = shift->openapi->valid_input or return; |
213 |
|
214 |
return try { |
215 |
my $list = Koha::Virtualshelves->find( $c->param('list_id') ); |
216 |
|
217 |
return $c->render_resource_not_found("List") |
218 |
unless $list; |
219 |
|
220 |
my $user = $c->stash('koha.user'); |
221 |
|
222 |
# If no user is logged in, only allow access to public lists |
223 |
unless ($user) { |
224 |
return $c->render( |
225 |
status => 403, |
226 |
openapi => { |
227 |
error => "Forbidden - anonymous users can only view public lists", |
228 |
error_code => "forbidden" |
229 |
} |
230 |
) unless $list->public; |
231 |
|
232 |
return $c->render( |
233 |
status => 200, |
234 |
openapi => $list->to_api |
235 |
); |
236 |
} |
237 |
|
238 |
# For logged in users, check ownership and public status |
239 |
unless ( $list->owner == $user->id || $list->public == 1 ) { |
240 |
return $c->render( |
241 |
status => 403, |
242 |
openapi => { |
243 |
error => "Forbidden - you can only view your own lists or public lists", |
244 |
error_code => "forbidden" |
245 |
} |
246 |
); |
247 |
} |
248 |
|
249 |
return $c->render( |
250 |
status => 200, |
251 |
openapi => $list->to_api |
252 |
); |
253 |
} catch { |
254 |
$c->unhandled_exception($_); |
255 |
}; |
256 |
} |
257 |
|
258 |
=head3 public_update |
259 |
|
260 |
Update a public virtual shelf or a shelf you own |
261 |
|
262 |
=cut |
263 |
|
264 |
sub public_update { |
265 |
my $c = shift->openapi->valid_input or return; |
266 |
|
267 |
my $user = $c->stash('koha.user'); |
268 |
|
269 |
# Handle anonymous users first |
270 |
unless ($user) { |
271 |
return $c->render( |
272 |
status => 401, |
273 |
openapi => { |
274 |
error => "Authentication required", |
275 |
error_code => "authentication_required" |
276 |
} |
277 |
); |
278 |
} |
279 |
|
280 |
my $list = Koha::Virtualshelves->find( $c->param('list_id') ); |
281 |
|
282 |
return $c->render_resource_not_found("List") |
283 |
unless $list; |
284 |
|
285 |
if ( $list->owner != $user->id ) { |
286 |
return $c->render( |
287 |
status => 403, |
288 |
openapi => { |
289 |
error => "Forbidden - you can only update your own lists", |
290 |
error_code => "forbidden" |
291 |
} |
292 |
); |
293 |
} |
294 |
|
295 |
if ( $list->allow_change_from_owner == 0 ) { |
296 |
return $c->render( |
297 |
status => 403, |
298 |
openapi => { |
299 |
error => "Forbidden - you can't update this list", |
300 |
error_code => "forbidden" |
301 |
} |
302 |
); |
303 |
} |
304 |
|
305 |
return try { |
306 |
$list->set_from_api( $c->req->json ); |
307 |
$list->store(); |
308 |
|
309 |
return $c->render( |
310 |
status => 200, |
311 |
openapi => $list->to_api |
312 |
); |
313 |
} catch { |
314 |
$c->unhandled_exception($_); |
315 |
}; |
316 |
} |
317 |
|
318 |
=head3 public_delete |
319 |
|
320 |
Delete a public virtual shelf you own |
321 |
|
322 |
=cut |
323 |
|
324 |
sub public_delete { |
325 |
my $c = shift->openapi->valid_input or return; |
326 |
|
327 |
my $user = $c->stash('koha.user'); |
328 |
|
329 |
# Handle anonymous users first |
330 |
unless ($user) { |
331 |
return $c->render( |
332 |
status => 401, |
333 |
openapi => { |
334 |
error => "Authentication required", |
335 |
error_code => "authentication_required" |
336 |
} |
337 |
); |
338 |
} |
339 |
|
340 |
my $list = Koha::Virtualshelves->find( $c->param('list_id') ); |
341 |
|
342 |
return $c->render_resource_not_found("List") |
343 |
unless $list; |
344 |
|
345 |
# Check ownership |
346 |
if ( $list->owner != $user->id ) { |
347 |
return $c->render( |
348 |
status => 403, |
349 |
openapi => { |
350 |
error => "Forbidden - you can only delete your own lists", |
351 |
error_code => "forbidden" |
352 |
} |
353 |
); |
354 |
} |
355 |
|
356 |
# Check if modifications allowed |
357 |
if ( $list->allow_change_from_owner == 0 ) { |
358 |
return $c->render( |
359 |
status => 403, |
360 |
openapi => { |
361 |
error => "Forbidden - you can't delete this list", |
362 |
error_code => "forbidden" |
363 |
} |
364 |
); |
365 |
} |
366 |
|
367 |
return try { |
368 |
$list->delete; |
369 |
return $c->render_resource_deleted; |
370 |
} catch { |
371 |
$c->unhandled_exception($_); |
372 |
}; |
373 |
} |
374 |
|
165 |
=head3 list_public |
375 |
=head3 list_public |
166 |
|
376 |
|
167 |
=cut |
377 |
=cut |
168 |
- |
|
|