|
Lines 17-24
Link Here
|
| 17 |
|
17 |
|
| 18 |
use Modern::Perl; |
18 |
use Modern::Perl; |
| 19 |
|
19 |
|
| 20 |
use Test::More tests => 39; |
20 |
use Test::More tests => 4; |
| 21 |
use Test::Mojo; |
21 |
use Test::Mojo; |
|
|
22 |
use t::lib::TestBuilder; |
| 22 |
|
23 |
|
| 23 |
use DateTime; |
24 |
use DateTime; |
| 24 |
|
25 |
|
|
Lines 30-48
use C4::Reserves;
Link Here
|
| 30 |
use Koha::Database; |
31 |
use Koha::Database; |
| 31 |
use Koha::Patron; |
32 |
use Koha::Patron; |
| 32 |
|
33 |
|
|
|
34 |
my $builder = t::lib::TestBuilder->new(); |
| 35 |
|
| 33 |
my $dbh = C4::Context->dbh; |
36 |
my $dbh = C4::Context->dbh; |
| 34 |
$dbh->{AutoCommit} = 0; |
37 |
$dbh->{AutoCommit} = 0; |
| 35 |
$dbh->{RaiseError} = 1; |
38 |
$dbh->{RaiseError} = 1; |
| 36 |
|
39 |
|
|
|
40 |
$ENV{REMOTE_ADDR} = '127.0.0.1'; |
| 37 |
my $t = Test::Mojo->new('Koha::REST::V1'); |
41 |
my $t = Test::Mojo->new('Koha::REST::V1'); |
|
|
42 |
my $tx; |
| 38 |
|
43 |
|
| 39 |
my $categorycode = Koha::Database->new()->schema()->resultset('Category')->first()->categorycode(); |
44 |
my $categorycode = Koha::Database->new()->schema()->resultset('Category')->first()->categorycode(); |
| 40 |
my $branchcode = Koha::Database->new()->schema()->resultset('Branch')->first()->branchcode(); |
45 |
my $branchcode = Koha::Database->new()->schema()->resultset('Branch')->first()->branchcode(); |
| 41 |
|
46 |
|
|
|
47 |
# User without any permissions |
| 48 |
my $nopermission = $builder->build({ |
| 49 |
source => 'Borrower', |
| 50 |
value => { |
| 51 |
branchcode => $branchcode, |
| 52 |
categorycode => $categorycode, |
| 53 |
flags => 0 |
| 54 |
} |
| 55 |
}); |
| 56 |
my $session_nopermission = C4::Auth::get_session(''); |
| 57 |
$session_nopermission->param('number', $nopermission->{ borrowernumber }); |
| 58 |
$session_nopermission->param('id', $nopermission->{ userid }); |
| 59 |
$session_nopermission->param('ip', '127.0.0.1'); |
| 60 |
$session_nopermission->param('lasttime', time()); |
| 61 |
$session_nopermission->flush; |
| 62 |
|
| 42 |
my $borrower = Koha::Patron->new; |
63 |
my $borrower = Koha::Patron->new; |
| 43 |
$borrower->categorycode( $categorycode ); |
64 |
$borrower->categorycode( $categorycode ); |
| 44 |
$borrower->branchcode( $branchcode ); |
65 |
$borrower->branchcode( $branchcode ); |
| 45 |
$borrower->surname("Test Surname"); |
66 |
$borrower->surname("Test Surname"); |
|
|
67 |
$borrower->flags(80); #borrowers and reserveforothers flags |
| 68 |
$borrower->userid($nopermission->{ userid }."z"); |
| 46 |
$borrower->store; |
69 |
$borrower->store; |
| 47 |
my $borrowernumber = $borrower->borrowernumber; |
70 |
my $borrowernumber = $borrower->borrowernumber; |
| 48 |
|
71 |
|
|
Lines 50-58
my $borrower2 = Koha::Patron->new;
Link Here
|
| 50 |
$borrower2->categorycode( $categorycode ); |
73 |
$borrower2->categorycode( $categorycode ); |
| 51 |
$borrower2->branchcode( $branchcode ); |
74 |
$borrower2->branchcode( $branchcode ); |
| 52 |
$borrower2->surname("Test Surname 2"); |
75 |
$borrower2->surname("Test Surname 2"); |
|
|
76 |
$borrower2->userid($nopermission->{ userid }."x"); |
| 77 |
$borrower2->flags(16); # borrowers flag |
| 53 |
$borrower2->store; |
78 |
$borrower2->store; |
| 54 |
my $borrowernumber2 = $borrower2->borrowernumber; |
79 |
my $borrowernumber2 = $borrower2->borrowernumber; |
| 55 |
|
80 |
|
|
|
81 |
my $borrower3 = Koha::Patron->new; |
| 82 |
$borrower3->categorycode( $categorycode ); |
| 83 |
$borrower3->branchcode( $branchcode ); |
| 84 |
$borrower3->surname("Test Surname 2"); |
| 85 |
$borrower3->userid($nopermission->{ userid }."y"); |
| 86 |
$borrower3->flags(64); # reserveforothers flag |
| 87 |
$borrower3->store; |
| 88 |
my $borrowernumber3 = $borrower3->borrowernumber; |
| 89 |
|
| 90 |
# Get sessions |
| 91 |
my $session = C4::Auth::get_session(''); |
| 92 |
$session->param('number', $borrower->borrowernumber); |
| 93 |
$session->param('id', $borrower->userid); |
| 94 |
$session->param('ip', '127.0.0.1'); |
| 95 |
$session->param('lasttime', time()); |
| 96 |
$session->flush; |
| 97 |
my $session2 = C4::Auth::get_session(''); |
| 98 |
$session2->param('number', $borrower2->borrowernumber); |
| 99 |
$session2->param('id', $borrower2->userid); |
| 100 |
$session2->param('ip', '127.0.0.1'); |
| 101 |
$session2->param('lasttime', time()); |
| 102 |
$session2->flush; |
| 103 |
my $session3 = C4::Auth::get_session(''); |
| 104 |
$session3->param('number', $borrower3->borrowernumber); |
| 105 |
$session3->param('id', $borrower3->userid); |
| 106 |
$session3->param('ip', '127.0.0.1'); |
| 107 |
$session3->param('lasttime', time()); |
| 108 |
$session3->flush; |
| 109 |
|
| 56 |
my $biblionumber = create_biblio('RESTful Web APIs'); |
110 |
my $biblionumber = create_biblio('RESTful Web APIs'); |
| 57 |
my $itemnumber = create_item($biblionumber, 'TEST000001'); |
111 |
my $itemnumber = create_item($biblionumber, 'TEST000001'); |
| 58 |
|
112 |
|
|
Lines 62-120
my $reserve_id = C4::Reserves::AddReserve($branchcode, $borrowernumber,
Link Here
|
| 62 |
$biblionumber, undef, 1, undef, undef, undef, '', $itemnumber); |
116 |
$biblionumber, undef, 1, undef, undef, undef, '', $itemnumber); |
| 63 |
|
117 |
|
| 64 |
# Add another reserve to be able to change first reserve's rank |
118 |
# Add another reserve to be able to change first reserve's rank |
| 65 |
C4::Reserves::AddReserve($branchcode, $borrowernumber2, |
119 |
my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $borrowernumber2, |
| 66 |
$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber); |
120 |
$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber); |
| 67 |
|
121 |
|
| 68 |
$t->get_ok('/api/v1/holds') |
|
|
| 69 |
->status_is(200) |
| 70 |
->json_has('/0') |
| 71 |
->json_has('/1') |
| 72 |
->json_hasnt('/2'); |
| 73 |
|
| 74 |
$t->get_ok('/api/v1/holds?priority=2') |
| 75 |
->status_is(200) |
| 76 |
->json_is('/0/borrowernumber', $borrowernumber2) |
| 77 |
->json_hasnt('/1'); |
| 78 |
|
| 79 |
my $suspend_until = DateTime->now->add(days => 10)->ymd; |
122 |
my $suspend_until = DateTime->now->add(days => 10)->ymd; |
| 80 |
my $put_data = { |
|
|
| 81 |
priority => 2, |
| 82 |
suspend_until => $suspend_until, |
| 83 |
}; |
| 84 |
$t->put_ok("/api/v1/holds/$reserve_id" => json => $put_data) |
| 85 |
->status_is(200) |
| 86 |
->json_is('/reserve_id', $reserve_id) |
| 87 |
->json_is('/suspend_until', $suspend_until . ' 00:00:00') |
| 88 |
->json_is('/priority', 2); |
| 89 |
|
| 90 |
$t->delete_ok("/api/v1/holds/$reserve_id") |
| 91 |
->status_is(200); |
| 92 |
|
| 93 |
$t->put_ok("/api/v1/holds/$reserve_id" => json => $put_data) |
| 94 |
->status_is(404) |
| 95 |
->json_has('/error'); |
| 96 |
|
| 97 |
$t->delete_ok("/api/v1/holds/$reserve_id") |
| 98 |
->status_is(404) |
| 99 |
->json_has('/error'); |
| 100 |
|
| 101 |
|
| 102 |
$t->get_ok("/api/v1/holds?borrowernumber=$borrowernumber") |
| 103 |
->status_is(200) |
| 104 |
->json_is([]); |
| 105 |
|
| 106 |
my $inexisting_borrowernumber = $borrowernumber2 + 1; |
| 107 |
$t->get_ok("/api/v1/holds?borrowernumber=$inexisting_borrowernumber") |
| 108 |
->status_is(200) |
| 109 |
->json_is([]); |
| 110 |
|
| 111 |
$dbh->do('DELETE FROM issuingrules'); |
| 112 |
$dbh->do(q{ |
| 113 |
INSERT INTO issuingrules (categorycode, branchcode, itemtype, reservesallowed) |
| 114 |
VALUES (?, ?, ?, ?) |
| 115 |
}, {}, '*', '*', '*', 1); |
| 116 |
|
| 117 |
my $expirationdate = DateTime->now->add(days => 10)->ymd; |
123 |
my $expirationdate = DateTime->now->add(days => 10)->ymd; |
|
|
124 |
|
| 118 |
my $post_data = { |
125 |
my $post_data = { |
| 119 |
borrowernumber => int($borrowernumber), |
126 |
borrowernumber => int($borrowernumber), |
| 120 |
biblionumber => int($biblionumber), |
127 |
biblionumber => int($biblionumber), |
|
Lines 122-142
my $post_data = {
Link Here
|
| 122 |
branchcode => $branchcode, |
129 |
branchcode => $branchcode, |
| 123 |
expirationdate => $expirationdate, |
130 |
expirationdate => $expirationdate, |
| 124 |
}; |
131 |
}; |
| 125 |
$t->post_ok("/api/v1/holds" => json => $post_data) |
132 |
my $put_data = { |
| 126 |
->status_is(201) |
133 |
priority => 2, |
| 127 |
->json_has('/reserve_id'); |
134 |
suspend_until => $suspend_until, |
|
|
135 |
}; |
| 136 |
|
| 137 |
subtest "Test endpoints without authentication" => sub { |
| 138 |
plan tests => 8; |
| 139 |
$t->get_ok('/api/v1/holds') |
| 140 |
->status_is(401); |
| 141 |
$t->post_ok('/api/v1/holds') |
| 142 |
->status_is(401); |
| 143 |
$t->put_ok('/api/v1/holds/0') |
| 144 |
->status_is(401); |
| 145 |
$t->delete_ok('/api/v1/holds/0') |
| 146 |
->status_is(401); |
| 147 |
}; |
| 128 |
|
148 |
|
| 129 |
$reserve_id = $t->tx->res->json->{reserve_id}; |
|
|
| 130 |
|
149 |
|
| 131 |
$t->get_ok("/api/v1/holds?borrowernumber=$borrowernumber") |
150 |
subtest "Test endpoints without permission" => sub { |
| 132 |
->status_is(200) |
151 |
plan tests => 10; |
| 133 |
->json_is('/0/reserve_id', $reserve_id) |
152 |
|
| 134 |
->json_is('/0/expirationdate', $expirationdate) |
153 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber"); |
| 135 |
->json_is('/0/branchcode', $branchcode); |
154 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
|
|
155 |
$t->request_ok($tx) # no permission |
| 156 |
->status_is(403); |
| 157 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber"); |
| 158 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 159 |
$t->request_ok($tx) # reserveforothers permission |
| 160 |
->status_is(403); |
| 161 |
$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data ); |
| 162 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 163 |
$t->request_ok($tx) # no permission |
| 164 |
->status_is(403); |
| 165 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/0" => json => $put_data ); |
| 166 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 167 |
$t->request_ok($tx) # no permission |
| 168 |
->status_is(403); |
| 169 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/0"); |
| 170 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 171 |
$t->request_ok($tx) # no permission |
| 172 |
->status_is(403); |
| 173 |
}; |
| 174 |
subtest "Test endpoints without permission, but accessing own object" => sub { |
| 175 |
plan tests => 15; |
| 176 |
|
| 177 |
my $borrno_tmp = $post_data->{'borrowernumber'}; |
| 178 |
$post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'}; |
| 179 |
$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data); |
| 180 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 181 |
$t->request_ok($tx) # create hold to myself |
| 182 |
->status_is(201) |
| 183 |
->json_has('/reserve_id'); |
| 184 |
|
| 185 |
$post_data->{'borrowernumber'} = $borrno_tmp; |
| 186 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=".$nopermission-> { borrowernumber }); |
| 187 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 188 |
$t->request_ok($tx) # get my own holds |
| 189 |
->status_is(200) |
| 190 |
->json_is('/0/borrowernumber', $nopermission->{ borrowernumber }) |
| 191 |
->json_is('/0/biblionumber', $biblionumber) |
| 192 |
->json_is('/0/itemnumber', $itemnumber) |
| 193 |
->json_is('/0/expirationdate', $expirationdate) |
| 194 |
->json_is('/0/branchcode', $branchcode); |
| 195 |
|
| 196 |
my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id; |
| 197 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data); |
| 198 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 199 |
$t->request_ok($tx) # create hold to myself |
| 200 |
->status_is(200) |
| 201 |
->json_is('/reserve_id', $reserve_id3) |
| 202 |
->json_is('/suspend_until', $suspend_until . ' 00:00:00') |
| 203 |
->json_is('/priority', 2); |
| 204 |
}; |
| 136 |
|
205 |
|
| 137 |
$t->post_ok("/api/v1/holds" => json => $post_data) |
206 |
subtest "Test endpoints with permission" => sub { |
| 138 |
->status_is(403) |
207 |
plan tests => 42; |
| 139 |
->json_like('/error', qr/tooManyReserves/); |
208 |
|
|
|
209 |
$tx = $t->ua->build_tx(GET => '/api/v1/holds'); |
| 210 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
| 211 |
$t->request_ok($tx) |
| 212 |
->status_is(200) |
| 213 |
->json_has('/0') |
| 214 |
->json_has('/1') |
| 215 |
->json_has('/2') |
| 216 |
->json_hasnt('/3'); |
| 217 |
|
| 218 |
$tx = $t->ua->build_tx(GET => '/api/v1/holds?priority=2'); |
| 219 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
| 220 |
$t->request_ok($tx) |
| 221 |
->status_is(200) |
| 222 |
->json_is('/0/borrowernumber', $nopermission->{borrowernumber}) |
| 223 |
->json_hasnt('/1'); |
| 224 |
|
| 225 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id" => json => $put_data); |
| 226 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 227 |
$t->request_ok($tx) |
| 228 |
->status_is(200) |
| 229 |
->json_is('/reserve_id', $reserve_id) |
| 230 |
->json_is('/suspend_until', $suspend_until . ' 00:00:00') |
| 231 |
->json_is('/priority', 2); |
| 232 |
|
| 233 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id"); |
| 234 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 235 |
$t->request_ok($tx) |
| 236 |
->status_is(200); |
| 237 |
|
| 238 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id" => json => $put_data); |
| 239 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 240 |
$t->request_ok($tx) |
| 241 |
->status_is(404) |
| 242 |
->json_has('/error'); |
| 243 |
|
| 244 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id"); |
| 245 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 246 |
$t->request_ok($tx) |
| 247 |
->status_is(404) |
| 248 |
->json_has('/error'); |
| 249 |
|
| 250 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=".$borrower->borrowernumber); |
| 251 |
$tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag |
| 252 |
$t->request_ok($tx) |
| 253 |
->status_is(200) |
| 254 |
->json_is([]); |
| 255 |
|
| 256 |
my $inexisting_borrowernumber = $borrowernumber2*2; |
| 257 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$inexisting_borrowernumber"); |
| 258 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
| 259 |
$t->request_ok($tx) |
| 260 |
->status_is(200) |
| 261 |
->json_is([]); |
| 262 |
|
| 263 |
$dbh->do('DELETE FROM issuingrules'); |
| 264 |
$dbh->do(q{ |
| 265 |
INSERT INTO issuingrules (categorycode, branchcode, itemtype, reservesallowed) |
| 266 |
VALUES (?, ?, ?, ?) |
| 267 |
}, {}, '*', '*', '*', 1); |
| 268 |
|
| 269 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id2"); |
| 270 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 271 |
$t->request_ok($tx) |
| 272 |
->status_is(200); |
| 273 |
|
| 274 |
$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data); |
| 275 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 276 |
$t->request_ok($tx) |
| 277 |
->status_is(201) |
| 278 |
->json_has('/reserve_id'); |
| 279 |
$reserve_id = $t->tx->res->json->{reserve_id}; |
| 280 |
|
| 281 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber"); |
| 282 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
| 283 |
$t->request_ok($tx) |
| 284 |
->status_is(200) |
| 285 |
->json_is('/0/reserve_id', $reserve_id) |
| 286 |
->json_is('/0/expirationdate', $expirationdate) |
| 287 |
->json_is('/0/branchcode', $branchcode); |
| 288 |
|
| 289 |
$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data); |
| 290 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 291 |
$t->request_ok($tx) |
| 292 |
->status_is(403) |
| 293 |
->json_like('/error', qr/tooManyReserves/); |
| 294 |
}; |
| 140 |
|
295 |
|
| 141 |
|
296 |
|
| 142 |
$dbh->rollback; |
297 |
$dbh->rollback; |
|
Lines 160-165
sub create_item {
Link Here
|
| 160 |
my $item = { |
315 |
my $item = { |
| 161 |
barcode => $barcode, |
316 |
barcode => $barcode, |
| 162 |
}; |
317 |
}; |
|
|
318 |
$dbh->do("DELETE FROM items WHERE barcode='$barcode'") if $barcode; |
| 163 |
|
319 |
|
| 164 |
my $itemnumber = C4::Items::AddItem($item, $biblionumber); |
320 |
my $itemnumber = C4::Items::AddItem($item, $biblionumber); |
| 165 |
|
321 |
|