Lines 17-24
Link Here
|
17 |
|
17 |
|
18 |
use Modern::Perl; |
18 |
use Modern::Perl; |
19 |
|
19 |
|
20 |
use Test::More tests => 39; |
20 |
use Test::More tests => 4; |
21 |
use Test::Mojo; |
21 |
use Test::Mojo; |
|
|
22 |
use t::lib::TestBuilder; |
22 |
|
23 |
|
23 |
use DateTime; |
24 |
use DateTime; |
24 |
|
25 |
|
Lines 30-48
use C4::Reserves;
Link Here
|
30 |
use Koha::Database; |
31 |
use Koha::Database; |
31 |
use Koha::Patron; |
32 |
use Koha::Patron; |
32 |
|
33 |
|
|
|
34 |
my $builder = t::lib::TestBuilder->new(); |
35 |
|
33 |
my $dbh = C4::Context->dbh; |
36 |
my $dbh = C4::Context->dbh; |
34 |
$dbh->{AutoCommit} = 0; |
37 |
$dbh->{AutoCommit} = 0; |
35 |
$dbh->{RaiseError} = 1; |
38 |
$dbh->{RaiseError} = 1; |
36 |
|
39 |
|
|
|
40 |
$ENV{REMOTE_ADDR} = '127.0.0.1'; |
37 |
my $t = Test::Mojo->new('Koha::REST::V1'); |
41 |
my $t = Test::Mojo->new('Koha::REST::V1'); |
|
|
42 |
my $tx; |
38 |
|
43 |
|
39 |
my $categorycode = Koha::Database->new()->schema()->resultset('Category')->first()->categorycode(); |
44 |
my $categorycode = Koha::Database->new()->schema()->resultset('Category')->first()->categorycode(); |
40 |
my $branchcode = Koha::Database->new()->schema()->resultset('Branch')->first()->branchcode(); |
45 |
my $branchcode = Koha::Database->new()->schema()->resultset('Branch')->first()->branchcode(); |
41 |
|
46 |
|
|
|
47 |
# User without any permissions |
48 |
my $nopermission = $builder->build({ |
49 |
source => 'Borrower', |
50 |
value => { |
51 |
branchcode => $branchcode, |
52 |
categorycode => $categorycode, |
53 |
flags => 0 |
54 |
} |
55 |
}); |
56 |
my $session_nopermission = C4::Auth::get_session(''); |
57 |
$session_nopermission->param('number', $nopermission->{ borrowernumber }); |
58 |
$session_nopermission->param('id', $nopermission->{ userid }); |
59 |
$session_nopermission->param('ip', '127.0.0.1'); |
60 |
$session_nopermission->param('lasttime', time()); |
61 |
$session_nopermission->flush; |
62 |
|
42 |
my $borrower = Koha::Patron->new; |
63 |
my $borrower = Koha::Patron->new; |
43 |
$borrower->categorycode( $categorycode ); |
64 |
$borrower->categorycode( $categorycode ); |
44 |
$borrower->branchcode( $branchcode ); |
65 |
$borrower->branchcode( $branchcode ); |
45 |
$borrower->surname("Test Surname"); |
66 |
$borrower->surname("Test Surname"); |
|
|
67 |
$borrower->flags(80); #borrowers and reserveforothers flags |
68 |
$borrower->userid($nopermission->{ userid }."z"); |
46 |
$borrower->store; |
69 |
$borrower->store; |
47 |
my $borrowernumber = $borrower->borrowernumber; |
70 |
my $borrowernumber = $borrower->borrowernumber; |
48 |
|
71 |
|
Lines 50-58
my $borrower2 = Koha::Patron->new;
Link Here
|
50 |
$borrower2->categorycode( $categorycode ); |
73 |
$borrower2->categorycode( $categorycode ); |
51 |
$borrower2->branchcode( $branchcode ); |
74 |
$borrower2->branchcode( $branchcode ); |
52 |
$borrower2->surname("Test Surname 2"); |
75 |
$borrower2->surname("Test Surname 2"); |
|
|
76 |
$borrower2->userid($nopermission->{ userid }."x"); |
77 |
$borrower2->flags(16); # borrowers flag |
53 |
$borrower2->store; |
78 |
$borrower2->store; |
54 |
my $borrowernumber2 = $borrower2->borrowernumber; |
79 |
my $borrowernumber2 = $borrower2->borrowernumber; |
55 |
|
80 |
|
|
|
81 |
my $borrower3 = Koha::Patron->new; |
82 |
$borrower3->categorycode( $categorycode ); |
83 |
$borrower3->branchcode( $branchcode ); |
84 |
$borrower3->surname("Test Surname 2"); |
85 |
$borrower3->userid($nopermission->{ userid }."y"); |
86 |
$borrower3->flags(64); # reserveforothers flag |
87 |
$borrower3->store; |
88 |
my $borrowernumber3 = $borrower3->borrowernumber; |
89 |
|
90 |
# Get sessions |
91 |
my $session = C4::Auth::get_session(''); |
92 |
$session->param('number', $borrower->borrowernumber); |
93 |
$session->param('id', $borrower->userid); |
94 |
$session->param('ip', '127.0.0.1'); |
95 |
$session->param('lasttime', time()); |
96 |
$session->flush; |
97 |
my $session2 = C4::Auth::get_session(''); |
98 |
$session2->param('number', $borrower2->borrowernumber); |
99 |
$session2->param('id', $borrower2->userid); |
100 |
$session2->param('ip', '127.0.0.1'); |
101 |
$session2->param('lasttime', time()); |
102 |
$session2->flush; |
103 |
my $session3 = C4::Auth::get_session(''); |
104 |
$session3->param('number', $borrower3->borrowernumber); |
105 |
$session3->param('id', $borrower3->userid); |
106 |
$session3->param('ip', '127.0.0.1'); |
107 |
$session3->param('lasttime', time()); |
108 |
$session3->flush; |
109 |
|
56 |
my $biblionumber = create_biblio('RESTful Web APIs'); |
110 |
my $biblionumber = create_biblio('RESTful Web APIs'); |
57 |
my $itemnumber = create_item($biblionumber, 'TEST000001'); |
111 |
my $itemnumber = create_item($biblionumber, 'TEST000001'); |
58 |
|
112 |
|
Lines 62-120
my $reserve_id = C4::Reserves::AddReserve($branchcode, $borrowernumber,
Link Here
|
62 |
$biblionumber, undef, 1, undef, undef, undef, '', $itemnumber); |
116 |
$biblionumber, undef, 1, undef, undef, undef, '', $itemnumber); |
63 |
|
117 |
|
64 |
# Add another reserve to be able to change first reserve's rank |
118 |
# Add another reserve to be able to change first reserve's rank |
65 |
C4::Reserves::AddReserve($branchcode, $borrowernumber2, |
119 |
my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $borrowernumber2, |
66 |
$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber); |
120 |
$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber); |
67 |
|
121 |
|
68 |
$t->get_ok('/api/v1/holds') |
|
|
69 |
->status_is(200) |
70 |
->json_has('/0') |
71 |
->json_has('/1') |
72 |
->json_hasnt('/2'); |
73 |
|
74 |
$t->get_ok('/api/v1/holds?priority=2') |
75 |
->status_is(200) |
76 |
->json_is('/0/borrowernumber', $borrowernumber2) |
77 |
->json_hasnt('/1'); |
78 |
|
79 |
my $suspend_until = DateTime->now->add(days => 10)->ymd; |
122 |
my $suspend_until = DateTime->now->add(days => 10)->ymd; |
80 |
my $put_data = { |
|
|
81 |
priority => 2, |
82 |
suspend_until => $suspend_until, |
83 |
}; |
84 |
$t->put_ok("/api/v1/holds/$reserve_id" => json => $put_data) |
85 |
->status_is(200) |
86 |
->json_is('/reserve_id', $reserve_id) |
87 |
->json_is('/suspend_until', $suspend_until . ' 00:00:00') |
88 |
->json_is('/priority', 2); |
89 |
|
90 |
$t->delete_ok("/api/v1/holds/$reserve_id") |
91 |
->status_is(200); |
92 |
|
93 |
$t->put_ok("/api/v1/holds/$reserve_id" => json => $put_data) |
94 |
->status_is(404) |
95 |
->json_has('/error'); |
96 |
|
97 |
$t->delete_ok("/api/v1/holds/$reserve_id") |
98 |
->status_is(404) |
99 |
->json_has('/error'); |
100 |
|
101 |
|
102 |
$t->get_ok("/api/v1/holds?borrowernumber=$borrowernumber") |
103 |
->status_is(200) |
104 |
->json_is([]); |
105 |
|
106 |
my $inexisting_borrowernumber = $borrowernumber2 + 1; |
107 |
$t->get_ok("/api/v1/holds?borrowernumber=$inexisting_borrowernumber") |
108 |
->status_is(200) |
109 |
->json_is([]); |
110 |
|
111 |
$dbh->do('DELETE FROM issuingrules'); |
112 |
$dbh->do(q{ |
113 |
INSERT INTO issuingrules (categorycode, branchcode, itemtype, reservesallowed) |
114 |
VALUES (?, ?, ?, ?) |
115 |
}, {}, '*', '*', '*', 1); |
116 |
|
117 |
my $expirationdate = DateTime->now->add(days => 10)->ymd; |
123 |
my $expirationdate = DateTime->now->add(days => 10)->ymd; |
|
|
124 |
|
118 |
my $post_data = { |
125 |
my $post_data = { |
119 |
borrowernumber => int($borrowernumber), |
126 |
borrowernumber => int($borrowernumber), |
120 |
biblionumber => int($biblionumber), |
127 |
biblionumber => int($biblionumber), |
Lines 122-142
my $post_data = {
Link Here
|
122 |
branchcode => $branchcode, |
129 |
branchcode => $branchcode, |
123 |
expirationdate => $expirationdate, |
130 |
expirationdate => $expirationdate, |
124 |
}; |
131 |
}; |
125 |
$t->post_ok("/api/v1/holds" => json => $post_data) |
132 |
my $put_data = { |
126 |
->status_is(201) |
133 |
priority => 2, |
127 |
->json_has('/reserve_id'); |
134 |
suspend_until => $suspend_until, |
|
|
135 |
}; |
136 |
|
137 |
subtest "Test endpoints without authentication" => sub { |
138 |
plan tests => 8; |
139 |
$t->get_ok('/api/v1/holds') |
140 |
->status_is(401); |
141 |
$t->post_ok('/api/v1/holds') |
142 |
->status_is(401); |
143 |
$t->put_ok('/api/v1/holds/0') |
144 |
->status_is(401); |
145 |
$t->delete_ok('/api/v1/holds/0') |
146 |
->status_is(401); |
147 |
}; |
128 |
|
148 |
|
129 |
$reserve_id = $t->tx->res->json->{reserve_id}; |
|
|
130 |
|
149 |
|
131 |
$t->get_ok("/api/v1/holds?borrowernumber=$borrowernumber") |
150 |
subtest "Test endpoints without permission" => sub { |
132 |
->status_is(200) |
151 |
plan tests => 10; |
133 |
->json_is('/0/reserve_id', $reserve_id) |
152 |
|
134 |
->json_is('/0/expirationdate', $expirationdate) |
153 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber"); |
135 |
->json_is('/0/branchcode', $branchcode); |
154 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
|
|
155 |
$t->request_ok($tx) # no permission |
156 |
->status_is(403); |
157 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber"); |
158 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
159 |
$t->request_ok($tx) # reserveforothers permission |
160 |
->status_is(403); |
161 |
$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data ); |
162 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
163 |
$t->request_ok($tx) # no permission |
164 |
->status_is(403); |
165 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/0" => json => $put_data ); |
166 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
167 |
$t->request_ok($tx) # no permission |
168 |
->status_is(403); |
169 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/0"); |
170 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
171 |
$t->request_ok($tx) # no permission |
172 |
->status_is(403); |
173 |
}; |
174 |
subtest "Test endpoints without permission, but accessing own object" => sub { |
175 |
plan tests => 15; |
176 |
|
177 |
my $borrno_tmp = $post_data->{'borrowernumber'}; |
178 |
$post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'}; |
179 |
$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data); |
180 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
181 |
$t->request_ok($tx) # create hold to myself |
182 |
->status_is(201) |
183 |
->json_has('/reserve_id'); |
184 |
|
185 |
$post_data->{'borrowernumber'} = $borrno_tmp; |
186 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=".$nopermission-> { borrowernumber }); |
187 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
188 |
$t->request_ok($tx) # get my own holds |
189 |
->status_is(200) |
190 |
->json_is('/0/borrowernumber', $nopermission->{ borrowernumber }) |
191 |
->json_is('/0/biblionumber', $biblionumber) |
192 |
->json_is('/0/itemnumber', $itemnumber) |
193 |
->json_is('/0/expirationdate', $expirationdate) |
194 |
->json_is('/0/branchcode', $branchcode); |
195 |
|
196 |
my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id; |
197 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data); |
198 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
199 |
$t->request_ok($tx) # create hold to myself |
200 |
->status_is(200) |
201 |
->json_is('/reserve_id', $reserve_id3) |
202 |
->json_is('/suspend_until', $suspend_until . ' 00:00:00') |
203 |
->json_is('/priority', 2); |
204 |
}; |
136 |
|
205 |
|
137 |
$t->post_ok("/api/v1/holds" => json => $post_data) |
206 |
subtest "Test endpoints with permission" => sub { |
138 |
->status_is(403) |
207 |
plan tests => 42; |
139 |
->json_like('/error', qr/tooManyReserves/); |
208 |
|
|
|
209 |
$tx = $t->ua->build_tx(GET => '/api/v1/holds'); |
210 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
211 |
$t->request_ok($tx) |
212 |
->status_is(200) |
213 |
->json_has('/0') |
214 |
->json_has('/1') |
215 |
->json_has('/2') |
216 |
->json_hasnt('/3'); |
217 |
|
218 |
$tx = $t->ua->build_tx(GET => '/api/v1/holds?priority=2'); |
219 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
220 |
$t->request_ok($tx) |
221 |
->status_is(200) |
222 |
->json_is('/0/borrowernumber', $nopermission->{borrowernumber}) |
223 |
->json_hasnt('/1'); |
224 |
|
225 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id" => json => $put_data); |
226 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
227 |
$t->request_ok($tx) |
228 |
->status_is(200) |
229 |
->json_is('/reserve_id', $reserve_id) |
230 |
->json_is('/suspend_until', $suspend_until . ' 00:00:00') |
231 |
->json_is('/priority', 2); |
232 |
|
233 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id"); |
234 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
235 |
$t->request_ok($tx) |
236 |
->status_is(200); |
237 |
|
238 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id" => json => $put_data); |
239 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
240 |
$t->request_ok($tx) |
241 |
->status_is(404) |
242 |
->json_has('/error'); |
243 |
|
244 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id"); |
245 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
246 |
$t->request_ok($tx) |
247 |
->status_is(404) |
248 |
->json_has('/error'); |
249 |
|
250 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=".$borrower->borrowernumber); |
251 |
$tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag |
252 |
$t->request_ok($tx) |
253 |
->status_is(200) |
254 |
->json_is([]); |
255 |
|
256 |
my $inexisting_borrowernumber = $borrowernumber2*2; |
257 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$inexisting_borrowernumber"); |
258 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
259 |
$t->request_ok($tx) |
260 |
->status_is(200) |
261 |
->json_is([]); |
262 |
|
263 |
$dbh->do('DELETE FROM issuingrules'); |
264 |
$dbh->do(q{ |
265 |
INSERT INTO issuingrules (categorycode, branchcode, itemtype, reservesallowed) |
266 |
VALUES (?, ?, ?, ?) |
267 |
}, {}, '*', '*', '*', 1); |
268 |
|
269 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id2"); |
270 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
271 |
$t->request_ok($tx) |
272 |
->status_is(200); |
273 |
|
274 |
$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data); |
275 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
276 |
$t->request_ok($tx) |
277 |
->status_is(201) |
278 |
->json_has('/reserve_id'); |
279 |
$reserve_id = $t->tx->res->json->{reserve_id}; |
280 |
|
281 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber"); |
282 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
283 |
$t->request_ok($tx) |
284 |
->status_is(200) |
285 |
->json_is('/0/reserve_id', $reserve_id) |
286 |
->json_is('/0/expirationdate', $expirationdate) |
287 |
->json_is('/0/branchcode', $branchcode); |
288 |
|
289 |
$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data); |
290 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
291 |
$t->request_ok($tx) |
292 |
->status_is(403) |
293 |
->json_like('/error', qr/tooManyReserves/); |
294 |
}; |
140 |
|
295 |
|
141 |
|
296 |
|
142 |
$dbh->rollback; |
297 |
$dbh->rollback; |
Lines 160-165
sub create_item {
Link Here
|
160 |
my $item = { |
315 |
my $item = { |
161 |
barcode => $barcode, |
316 |
barcode => $barcode, |
162 |
}; |
317 |
}; |
|
|
318 |
$dbh->do("DELETE FROM items WHERE barcode='$barcode'") if $barcode; |
163 |
|
319 |
|
164 |
my $itemnumber = C4::Items::AddItem($item, $biblionumber); |
320 |
my $itemnumber = C4::Items::AddItem($item, $biblionumber); |
165 |
|
321 |
|