| Lines 225-231
          subtest "Test endpoints without permission" => sub {
      
      
        Link Here | 
        
          | 225 |       ->status_is(403); | 225 |       ->status_is(403); | 
        
          | 226 | }; | 226 | }; | 
        
          | 227 | subtest "Test endpoints without permission, but accessing own object" => sub { | 227 | subtest "Test endpoints without permission, but accessing own object" => sub { | 
          
            
              | 228 |     plan tests => 26; | 228 |     plan tests => 36; | 
        
          | 229 |  | 229 |  | 
        
          | 230 |     my $reserve_id3 = C4::Reserves::AddReserve($branchcode, $nopermission->{'borrowernumber'}, | 230 |     my $reserve_id3 = C4::Reserves::AddReserve($branchcode, $nopermission->{'borrowernumber'}, | 
        
          | 231 |     $biblionumber, undef, 2, undef, undef, undef, '', $itemnumber, 'W'); | 231 |     $biblionumber, undef, 2, undef, undef, undef, '', $itemnumber, 'W'); | 
  
    | Lines 319-324
          subtest "Test endpoints without permission, but accessing own object" => sub {
      
      
        Link Here | 
        
          | 319 |       ->status_is(200) | 319 |       ->status_is(200) | 
        
          | 320 |       ->json_is('/reserve_id', $reserve_id3) | 320 |       ->json_is('/reserve_id', $reserve_id3) | 
        
          | 321 |       ->json_is('/branchcode', $branchcode2); | 321 |       ->json_is('/branchcode', $branchcode2); | 
            
              |  |  | 322 |  | 
            
              | 323 |     $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => { | 
            
              | 324 |         suspend_until => $suspend_until | 
            
              | 325 |     }); | 
            
              | 326 |     $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); | 
            
              | 327 |     $t->request_ok($tx) # create hold to myself | 
            
              | 328 |       ->status_is(200) | 
            
              | 329 |       ->json_is('/reserve_id', $reserve_id3) | 
            
              | 330 |       ->json_is('/suspend', Mojo::JSON->true) | 
            
              | 331 |       ->json_like('/suspend_until', qr/^$suspend_until/); | 
            
              | 332 |  | 
            
              | 333 |     $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => { | 
            
              | 334 |         suspend => Mojo::JSON->false | 
            
              | 335 |     }); | 
            
              | 336 |     $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); | 
            
              | 337 |     $t->request_ok($tx) # create hold to myself | 
            
              | 338 |       ->status_is(200) | 
            
              | 339 |       ->json_is('/reserve_id', $reserve_id3) | 
            
              | 340 |       ->json_is('/suspend', Mojo::JSON->false) | 
            
              | 341 |       ->json_is('/suspend_until', undef); | 
        
          | 322 | }; | 342 | }; | 
        
          | 323 |  | 343 |  | 
        
          | 324 | subtest "Test endpoints with permission" => sub { | 344 | subtest "Test endpoints with permission" => sub { | 
            
              | 325 | -  |  |  |