View | Details | Raw Unified | Return to bug 41751
Collapse All | Expand All

(-)a/api/v1/swagger/paths/cash_registers.yaml (-2 / +6 lines)
Lines 115-121 Link Here
115
          $ref: "../swagger.yaml#/definitions/error"
115
          $ref: "../swagger.yaml#/definitions/error"
116
    x-koha-authorization:
116
    x-koha-authorization:
117
      permissions:
117
      permissions:
118
        cash_management: cashup
118
        cash_management:
119
          - cashup
120
          - anonymous_refund
119
"/cashups/{cashup_id}":
121
"/cashups/{cashup_id}":
120
  get:
122
  get:
121
    x-mojo-to: CashRegisters::Cashups#get
123
    x-mojo-to: CashRegisters::Cashups#get
Lines 167-170 Link Here
167
          $ref: "../swagger.yaml#/definitions/error"
169
          $ref: "../swagger.yaml#/definitions/error"
168
    x-koha-authorization:
170
    x-koha-authorization:
169
      permissions:
171
      permissions:
170
        cash_management: cashup
172
        cash_management:
173
          - cashup
174
          - anonymous_refund
(-)a/t/db_dependent/api/v1/cashups.t (-8 / +62 lines)
Lines 36-42 t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 ); Link Here
36
36
37
subtest 'list() tests' => sub {
37
subtest 'list() tests' => sub {
38
38
39
    plan tests => 17;
39
    plan tests => 19;
40
40
41
    $schema->storage->txn_begin;
41
    $schema->storage->txn_begin;
42
42
Lines 68-74 subtest 'list() tests' => sub { Link Here
68
    my $non_existent_cr_id      = $cash_register_to_delete->id;
68
    my $non_existent_cr_id      = $cash_register_to_delete->id;
69
    $cash_register_to_delete->delete;
69
    $cash_register_to_delete->delete;
70
70
71
    $t->get_ok("//$userid:$password@/api/v1/cash_registers/$non_existent_cr_id/cashups")->status_is(404)
71
    $t->get_ok("//$userid:$password@/api/v1/cash_registers/$non_existent_cr_id/cashups")
72
        ->status_is(404)
72
        ->json_is( '/error' => 'Register not found' );
73
        ->json_is( '/error' => 'Register not found' );
73
74
74
    my $register    = $builder->build_object( { class => 'Koha::Cash::Registers' } );
75
    my $register    = $builder->build_object( { class => 'Koha::Cash::Registers' } );
Lines 89-95 subtest 'list() tests' => sub { Link Here
89
    );
90
    );
90
91
91
    # One cashup created, should get returned
92
    # One cashup created, should get returned
92
    $t->get_ok("//$userid:$password@/api/v1/cash_registers/$register_id/cashups")->status_is(200)
93
    $t->get_ok("//$userid:$password@/api/v1/cash_registers/$register_id/cashups")
94
        ->status_is(200)
93
        ->json_is( [ $cashup->to_api ] );
95
        ->json_is( [ $cashup->to_api ] );
94
96
95
    my $another_cashup = $builder->build_object(
97
    my $another_cashup = $builder->build_object(
Lines 104-114 subtest 'list() tests' => sub { Link Here
104
    );
106
    );
105
107
106
    # One more cashup created, both should be returned
108
    # One more cashup created, both should be returned
107
    $t->get_ok("//$userid:$password@/api/v1/cash_registers/$register_id/cashups")->status_is(200)
109
    $t->get_ok("//$userid:$password@/api/v1/cash_registers/$register_id/cashups")
110
        ->status_is(200)
108
        ->json_is( [ $another_cashup->to_api, $cashup->to_api, ] );
111
        ->json_is( [ $another_cashup->to_api, $cashup->to_api, ] );
109
112
110
    # Warn on unsupported query parameter
113
    # Warn on unsupported query parameter
111
    $t->get_ok("//$userid:$password@/api/v1/cash_registers/$register_id/cashups?cashup_blah=blah")->status_is(400)
114
    $t->get_ok("//$userid:$password@/api/v1/cash_registers/$register_id/cashups?cashup_blah=blah")
115
        ->status_is(400)
112
        ->json_is(
116
        ->json_is(
113
        [
117
        [
114
            {
118
            {
Lines 121-132 subtest 'list() tests' => sub { Link Here
121
    # Unauthorized access
125
    # Unauthorized access
122
    $t->get_ok("//$unauth_userid:$password@/api/v1/cash_registers/$register_id/cashups")->status_is(403);
126
    $t->get_ok("//$unauth_userid:$password@/api/v1/cash_registers/$register_id/cashups")->status_is(403);
123
127
128
    # Test that anonymous_refund permission also grants access (bug fix)
129
    my $refund_librarian = $builder->build_object(
130
        {
131
            class => 'Koha::Patrons',
132
            value => { flags => 0 }
133
        }
134
    );
135
    $refund_librarian->set_password( { password => $password, skip_validation => 1 } );
136
    my $refund_userid = $refund_librarian->userid;
137
138
    $builder->build(
139
        {
140
            source => 'UserPermission',
141
            value  => {
142
                borrowernumber => $refund_librarian->borrowernumber,
143
                module_bit     => 25,                                  # cash_management
144
                code           => 'anonymous_refund',
145
            },
146
        }
147
    );
148
149
    $t->get_ok("//$refund_userid:$password@/api/v1/cash_registers/$register_id/cashups")
150
        ->status_is(200)
151
        ->or( sub { diag "anonymous_refund permission should allow access to cashups list" } );
152
124
    $schema->storage->txn_rollback;
153
    $schema->storage->txn_rollback;
125
};
154
};
126
155
127
subtest 'get() tests' => sub {
156
subtest 'get() tests' => sub {
128
157
129
    plan tests => 8;
158
    plan tests => 10;
130
159
131
    $schema->storage->txn_begin;
160
    $schema->storage->txn_begin;
132
161
Lines 159-166 subtest 'get() tests' => sub { Link Here
159
    my $non_existent_id  = $cashup_to_delete->id;
188
    my $non_existent_id  = $cashup_to_delete->id;
160
    $cashup_to_delete->delete;
189
    $cashup_to_delete->delete;
161
190
162
    $t->get_ok("//$userid:$password@/api/v1/cashups/$non_existent_id")->status_is(404)
191
    $t->get_ok("//$userid:$password@/api/v1/cashups/$non_existent_id")
192
        ->status_is(404)
163
        ->json_is( '/error' => 'Cashup not found' );
193
        ->json_is( '/error' => 'Cashup not found' );
164
194
195
    # Test that anonymous_refund permission also grants access (bug fix)
196
    my $refund_librarian = $builder->build_object(
197
        {
198
            class => 'Koha::Patrons',
199
            value => { flags => 0 }
200
        }
201
    );
202
    $refund_librarian->set_password( { password => $password, skip_validation => 1 } );
203
    my $refund_userid = $refund_librarian->userid;
204
205
    $builder->build(
206
        {
207
            source => 'UserPermission',
208
            value  => {
209
                borrowernumber => $refund_librarian->borrowernumber,
210
                module_bit     => 25,                                  # cash_management
211
                code           => 'anonymous_refund',
212
            },
213
        }
214
    );
215
216
    $t->get_ok( "//$refund_userid:$password@/api/v1/cashups/" . $cashup->id )
217
        ->status_is(200)
218
        ->or( sub { diag "anonymous_refund permission should allow access to get cashup" } );
219
165
    $schema->storage->txn_rollback;
220
    $schema->storage->txn_rollback;
166
};
221
};
167
- 

Return to bug 41751