|
Lines 180-186
subtest "Test endpoints without permission" => sub {
Link Here
|
| 180 |
->status_is(403); |
180 |
->status_is(403); |
| 181 |
}; |
181 |
}; |
| 182 |
subtest "Test endpoints without permission, but accessing own object" => sub { |
182 |
subtest "Test endpoints without permission, but accessing own object" => sub { |
| 183 |
plan tests => 15; |
183 |
plan tests => 21; |
|
|
184 |
|
| 185 |
my $reserve_id3 = C4::Reserves::AddReserve($branchcode, $nopermission->{'borrowernumber'}, |
| 186 |
$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber, 'W'); |
| 187 |
# try to delete my own hold while it's waiting; an error should occur |
| 188 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id3" => json => $put_data); |
| 189 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 190 |
$t->request_ok($tx) |
| 191 |
->status_is(403) |
| 192 |
->json_is('/error', 'Hold is already in transfer or waiting and cannot be cancelled by patron.'); |
| 193 |
# reset the hold's found status; after that, cancellation should work |
| 194 |
Koha::Holds->find($reserve_id3)->found('')->store; |
| 195 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id3" => json => $put_data); |
| 196 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 197 |
$t->request_ok($tx) |
| 198 |
->status_is(200); |
| 199 |
is(Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} }), undef, "Hold deleted."); |
| 184 |
|
200 |
|
| 185 |
my $borrno_tmp = $post_data->{'borrowernumber'}; |
201 |
my $borrno_tmp = $post_data->{'borrowernumber'}; |
| 186 |
$post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'}; |
202 |
$post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'}; |
|
Lines 201-207
subtest "Test endpoints without permission, but accessing own object" => sub {
Link Here
|
| 201 |
->json_is('/0/expirationdate', $expirationdate) |
217 |
->json_is('/0/expirationdate', $expirationdate) |
| 202 |
->json_is('/0/branchcode', $branchcode); |
218 |
->json_is('/0/branchcode', $branchcode); |
| 203 |
|
219 |
|
| 204 |
my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id; |
220 |
$reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id; |
| 205 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data); |
221 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data); |
| 206 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
222 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 207 |
$t->request_ok($tx) # create hold to myself |
223 |
$t->request_ok($tx) # create hold to myself |
| 208 |
- |
|
|