View | Details | Raw Unified | Return to bug 41751
Collapse All | Expand All

(-)a/api/v1/swagger/paths/cash_registers.yaml (-2 / +6 lines)
Lines 115-121 Link Here
115
          $ref: "../swagger.yaml#/definitions/error"
115
          $ref: "../swagger.yaml#/definitions/error"
116
    x-koha-authorization:
116
    x-koha-authorization:
117
      permissions:
117
      permissions:
118
        cash_management: cashup
118
        cash_management:
119
          - cashup
120
          - anonymous_refund
119
"/cashups/{cashup_id}":
121
"/cashups/{cashup_id}":
120
  get:
122
  get:
121
    x-mojo-to: CashRegisters::Cashups#get
123
    x-mojo-to: CashRegisters::Cashups#get
Lines 167-170 Link Here
167
          $ref: "../swagger.yaml#/definitions/error"
169
          $ref: "../swagger.yaml#/definitions/error"
168
    x-koha-authorization:
170
    x-koha-authorization:
169
      permissions:
171
      permissions:
170
        cash_management: cashup
172
        cash_management:
173
          - cashup
174
          - anonymous_refund
(-)a/t/db_dependent/api/v1/cashups.t (-3 / +52 lines)
Lines 36-42 t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 ); Link Here
36
36
37
subtest 'list() tests' => sub {
37
subtest 'list() tests' => sub {
38
38
39
    plan tests => 17;
39
    plan tests => 19;
40
40
41
    $schema->storage->txn_begin;
41
    $schema->storage->txn_begin;
42
42
Lines 125-136 subtest 'list() tests' => sub { Link Here
125
    # Unauthorized access
125
    # Unauthorized access
126
    $t->get_ok("//$unauth_userid:$password@/api/v1/cash_registers/$register_id/cashups")->status_is(403);
126
    $t->get_ok("//$unauth_userid:$password@/api/v1/cash_registers/$register_id/cashups")->status_is(403);
127
127
128
    # Test that anonymous_refund permission also grants access (bug fix)
129
    my $refund_librarian = $builder->build_object(
130
        {
131
            class => 'Koha::Patrons',
132
            value => { flags => 0 }
133
        }
134
    );
135
    $refund_librarian->set_password( { password => $password, skip_validation => 1 } );
136
    my $refund_userid = $refund_librarian->userid;
137
138
    $builder->build(
139
        {
140
            source => 'UserPermission',
141
            value  => {
142
                borrowernumber => $refund_librarian->borrowernumber,
143
                module_bit     => 25,                                  # cash_management
144
                code           => 'anonymous_refund',
145
            },
146
        }
147
    );
148
149
    $t->get_ok("//$refund_userid:$password@/api/v1/cash_registers/$register_id/cashups")
150
        ->status_is(200)
151
        ->or( sub { diag "anonymous_refund permission should allow access to cashups list" } );
152
128
    $schema->storage->txn_rollback;
153
    $schema->storage->txn_rollback;
129
};
154
};
130
155
131
subtest 'get() tests' => sub {
156
subtest 'get() tests' => sub {
132
157
133
    plan tests => 8;
158
    plan tests => 10;
134
159
135
    $schema->storage->txn_begin;
160
    $schema->storage->txn_begin;
136
161
Lines 167-171 subtest 'get() tests' => sub { Link Here
167
        ->status_is(404)
192
        ->status_is(404)
168
        ->json_is( '/error' => 'Cashup not found' );
193
        ->json_is( '/error' => 'Cashup not found' );
169
194
195
    # Test that anonymous_refund permission also grants access (bug fix)
196
    my $refund_librarian = $builder->build_object(
197
        {
198
            class => 'Koha::Patrons',
199
            value => { flags => 0 }
200
        }
201
    );
202
    $refund_librarian->set_password( { password => $password, skip_validation => 1 } );
203
    my $refund_userid = $refund_librarian->userid;
204
205
    $builder->build(
206
        {
207
            source => 'UserPermission',
208
            value  => {
209
                borrowernumber => $refund_librarian->borrowernumber,
210
                module_bit     => 25,                                  # cash_management
211
                code           => 'anonymous_refund',
212
            },
213
        }
214
    );
215
216
    $t->get_ok( "//$refund_userid:$password@/api/v1/cashups/" . $cashup->id )
217
        ->status_is(200)
218
        ->or( sub { diag "anonymous_refund permission should allow access to get cashup" } );
219
170
    $schema->storage->txn_rollback;
220
    $schema->storage->txn_rollback;
171
};
221
};
172
- 

Return to bug 41751