View | Details | Raw Unified | Return to bug 38050
Collapse All | Expand All

(-)a/Koha/REST/V1/Lists.pm (-1 / +189 lines)
Lines 140-145 sub delete { Link Here
140
    };
140
    };
141
}
141
}
142
142
143
=head3 public_add
144
145
Create a public virtual shelf
146
147
=cut
148
149
sub public_add {
150
    my $c = shift->openapi->valid_input or return;
151
152
    my $user = $c->stash('koha.user');
153
154
    # Handle anonymous users first
155
    unless ($user) {
156
        return $c->render(
157
            status  => 401,
158
            openapi => {
159
                error      => "Authentication required",
160
                error_code => "authentication_required"
161
            }
162
        );
163
    }
164
165
    my $body = $c->req->json;
166
    $body->{owner} = $user->id;
167
168
    return try {
169
        my $list = Koha::Virtualshelf->new_from_api($body);
170
        $list->store->discard_changes;
171
172
        $c->res->headers->location( $c->req->url->to_string . '/' . $list->id );
173
174
        return $c->render(
175
            status  => 201,
176
            openapi => $list->to_api
177
        );
178
    } catch {
179
        $c->unhandled_exception($_);
180
    };
181
}
182
183
=head3 public_get
184
185
List the contents of a public virtual shelf or a virtual shelf you own
186
187
=cut
188
189
sub public_get {
190
    my $c = shift->openapi->valid_input or return;
191
192
    return try {
193
        my $list = Koha::Virtualshelves->find( $c->param('list_id') );
194
195
        return $c->render_resource_not_found("List")
196
            unless $list;
197
198
        my $user = $c->stash('koha.user');
199
200
        # If no user is logged in, only allow access to public lists
201
        unless ($user) {
202
            return $c->render(
203
                status  => 403,
204
                openapi => {
205
                    error      => "Forbidden - anonymous users can only view public lists",
206
                    error_code => "forbidden"
207
                }
208
            ) unless $list->public;
209
210
            return $c->render(
211
                status  => 200,
212
                openapi => $list->to_api
213
            );
214
        }
215
216
        # For logged in users, check ownership and public status
217
        unless ( $list->owner == $user->id || $list->public == 1 ) {
218
            return $c->render(
219
                status  => 403,
220
                openapi => {
221
                    error      => "Forbidden - you can only view your own lists or public lists",
222
                    error_code => "forbidden"
223
                }
224
            );
225
        }
226
227
        return $c->render(
228
            status  => 200,
229
            openapi => $list->to_api
230
        );
231
    } catch {
232
        $c->unhandled_exception($_);
233
    };
234
}
235
236
=head3 public_update
237
238
Update a public virtual shelf or a shelf you own
239
240
=cut
241
242
sub public_update {
243
    my $c = shift->openapi->valid_input or return;
244
245
    my $user = $c->stash('koha.user');
246
247
    # Handle anonymous users first
248
    unless ($user) {
249
        return $c->render(
250
            status  => 401,
251
            openapi => {
252
                error      => "Authentication required",
253
                error_code => "authentication_required"
254
            }
255
        );
256
    }
257
258
    my $list = Koha::Virtualshelves->find( $c->param('list_id') );
259
260
    return $c->render_resource_not_found("List")
261
        unless $list;
262
263
    if ( $list->owner != $user->id ) {
264
        return $c->render(
265
            status  => 403,
266
            openapi => {
267
                error      => "Forbidden - you can only update your own lists",
268
                error_code => "forbidden"
269
            }
270
        );
271
    }
272
273
    return try {
274
        $list->set_from_api( $c->req->json );
275
        $list->store();
276
277
        return $c->render(
278
            status  => 200,
279
            openapi => $list->to_api
280
        );
281
    } catch {
282
        $c->unhandled_exception($_);
283
    };
284
}
285
286
=head3 public_delete
287
288
Delete a public virtual shelf you own
289
290
=cut
291
292
sub public_delete {
293
    my $c = shift->openapi->valid_input or return;
294
295
    my $user = $c->stash('koha.user');
296
297
    # Handle anonymous users first
298
    unless ($user) {
299
        return $c->render(
300
            status  => 401,
301
            openapi => {
302
                error      => "Authentication required",
303
                error_code => "authentication_required"
304
            }
305
        );
306
    }
307
308
    my $list = Koha::Virtualshelves->find( $c->param('list_id') );
309
310
    return $c->render_resource_not_found("List")
311
        unless $list;
312
313
    # Check ownership
314
    if ( $list->owner != $user->id ) {
315
        return $c->render(
316
            status  => 403,
317
            openapi => {
318
                error      => "Forbidden - you can only delete your own lists",
319
                error_code => "forbidden"
320
            }
321
        );
322
    }
323
324
    return try {
325
        $list->delete;
326
        return $c->render_resource_deleted;
327
    } catch {
328
        $c->unhandled_exception($_);
329
    };
330
}
331
143
=head3 list_public
332
=head3 list_public
144
333
145
=cut
334
=cut
146
- 

Return to bug 38050