View | Details | Raw Unified | Return to bug 41869
Collapse All | Expand All

(-)a/api/v1/swagger/paths/holds.yaml (-2 / +2 lines)
Lines 281-287 Link Here
281
          $ref: "../swagger.yaml#/definitions/error"
281
          $ref: "../swagger.yaml#/definitions/error"
282
    x-koha-authorization:
282
    x-koha-authorization:
283
      permissions:
283
      permissions:
284
        reserveforothers: "1"
284
        reserveforothers: place_holds
285
"/holds/suspension_bulk":
285
"/holds/suspension_bulk":
286
  post:
286
  post:
287
    x-mojo-to: Holds#suspend_bulk
287
    x-mojo-to: Holds#suspend_bulk
Lines 475-481 Link Here
475
          $ref: "../swagger.yaml#/definitions/error"
475
          $ref: "../swagger.yaml#/definitions/error"
476
    x-koha-authorization:
476
    x-koha-authorization:
477
      permissions:
477
      permissions:
478
        reserveforothers: "1"
478
        reserveforothers: place_holds
479
  put:
479
  put:
480
    x-mojo-to: Holds#edit
480
    x-mojo-to: Holds#edit
481
    operationId: overwriteHold
481
    operationId: overwriteHold
(-)a/t/db_dependent/api/v1/holds.t (-2 / +94 lines)
Lines 17-23 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 20;
20
use Test::More tests => 21;
21
use Test::NoWarnings;
21
use Test::NoWarnings;
22
use Test::MockModule;
22
use Test::MockModule;
23
use Test::Mojo;
23
use Test::Mojo;
Lines 347-352 subtest 'test AllowHoldDateInFuture' => sub { Link Here
347
        ->json_is( '/hold_date', output_pref( { dt => $future_hold_date, dateformat => 'iso', dateonly => 1 } ) );
347
        ->json_is( '/hold_date', output_pref( { dt => $future_hold_date, dateformat => 'iso', dateonly => 1 } ) );
348
};
348
};
349
349
350
subtest 'Test place_holds permission for POST and PATCH' => sub {
351
    plan tests => 7;
352
353
    $dbh->do('DELETE FROM reserves');
354
355
    # Create fresh biblio and item for this test
356
    my $test_biblio = $builder->build_sample_biblio;
357
    my $test_item   = $builder->build_sample_item( { biblionumber => $test_biblio->biblionumber, itype => $itemtype } );
358
359
    # Create a patron to receive the hold
360
    my $hold_recipient = $builder->build_object(
361
        {
362
            class => 'Koha::Patrons',
363
            value => {
364
                categorycode => $categorycode,
365
                branchcode   => $branchcode,
366
            }
367
        }
368
    );
369
370
    # Create two separate patrons to test with and without permissions
371
    # Patron WITHOUT place_holds permission
372
    my $patron_no_perm = $builder->build_object(
373
        {
374
            class => 'Koha::Patrons',
375
            value => {
376
                categorycode => $categorycode,
377
                branchcode   => $branchcode,
378
                flags        => 0
379
            }
380
        }
381
    );
382
    $patron_no_perm->set_password( { password => $password, skip_validation => 1 } );
383
    my $userid_no_perm = $patron_no_perm->userid;
384
385
    # Patron WITH place_holds permission
386
    my $patron_with_perm = $builder->build_object(
387
        {
388
            class => 'Koha::Patrons',
389
            value => {
390
                categorycode => $categorycode,
391
                branchcode   => $branchcode,
392
                flags        => 0
393
            }
394
        }
395
    );
396
    $builder->build(
397
        {
398
            source => 'UserPermission',
399
            value  => {
400
                borrowernumber => $patron_with_perm->borrowernumber,
401
                module_bit     => 6,
402
                code           => 'place_holds',
403
            },
404
        }
405
    );
406
    $patron_with_perm->set_password( { password => $password, skip_validation => 1 } );
407
    my $userid_with_perm = $patron_with_perm->userid;
408
409
    # place_holds is for placing holds for others
410
    my $test_post_data = {
411
        patron_id         => $hold_recipient->borrowernumber,
412
        biblio_id         => $test_biblio->biblionumber,
413
        item_id           => $test_item->itemnumber,
414
        pickup_library_id => $branchcode,
415
    };
416
417
    # Make sure pickup location checks doesn't get in the middle
418
    my $mock_biblio = Test::MockModule->new('Koha::Biblio');
419
    $mock_biblio->mock( 'pickup_locations', sub { return Koha::Libraries->search; } );
420
    my $mock_item = Test::MockModule->new('Koha::Item');
421
    $mock_item->mock( 'pickup_locations', sub { return Koha::Libraries->search } );
422
423
    # Test POST without place_holds permission - should fail
424
    $t->post_ok( "//$userid_no_perm:$password@/api/v1/holds" => json => $test_post_data )
425
        ->status_is(403, 'POST without place_holds permission returns 403');
426
427
    # Test POST with place_holds permission - should succeed
428
    $t->post_ok( "//$userid_with_perm:$password@/api/v1/holds" => json => $test_post_data )
429
        ->status_is(201, 'POST with place_holds permission returns 201')
430
        ->json_has('/hold_id');
431
432
    my $created_hold_id = $t->tx->res->json->{hold_id};
433
434
    # Test PATCH with place_holds permission - should succeed
435
    my $test_patch_data = {
436
        priority => 1,
437
    };
438
439
    $t->patch_ok( "//$userid_with_perm:$password@/api/v1/holds/$created_hold_id" => json => $test_patch_data )
440
        ->status_is(200, 'PATCH with place_holds permission returns 200');
441
};
442
350
$schema->storage->txn_rollback;
443
$schema->storage->txn_rollback;
351
444
352
subtest 'x-koha-override and AllowHoldPolicyOverride tests' => sub {
445
subtest 'x-koha-override and AllowHoldPolicyOverride tests' => sub {
353
- 

Return to bug 41869