| Lines 186-192
          subtest "Test endpoints without permission" => sub {
      
      
        Link Here | 
        
          | 186 |       ->status_is(403); | 186 |       ->status_is(403); | 
        
          | 187 | }; | 187 | }; | 
        
          | 188 | subtest "Test endpoints without permission, but accessing own object" => sub { | 188 | subtest "Test endpoints without permission, but accessing own object" => sub { | 
          
            
              | 189 |     plan tests => 15; | 189 |     plan tests => 25; | 
        
          | 190 |  | 190 |  | 
        
          | 191 |     my $borrno_tmp = $post_data->{'borrowernumber'}; | 191 |     my $borrno_tmp = $post_data->{'borrowernumber'}; | 
        
          | 192 |     $post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'}; | 192 |     $post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'}; | 
  
    | Lines 210-220
          subtest "Test endpoints without permission, but accessing own object" => sub {
      
      
        Link Here | 
        
          | 210 |     my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id; | 210 |     my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id; | 
        
          | 211 |     $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data); | 211 |     $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data); | 
        
          | 212 |     $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); | 212 |     $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); | 
          
            
              | 213 |     $t->request_ok($tx) # create hold to myself | 213 |     $t->request_ok($tx) | 
        
          | 214 |       ->status_is(200) | 214 |       ->status_is(200) | 
        
          | 215 |       ->json_is('/reserve_id', $reserve_id3) | 215 |       ->json_is('/reserve_id', $reserve_id3) | 
        
          | 216 |       ->json_is('/suspend_until', $suspend_until . ' 00:00:00') | 216 |       ->json_is('/suspend_until', $suspend_until . ' 00:00:00') | 
        
          | 217 |       ->json_is('/priority', 2); | 217 |       ->json_is('/priority', 2); | 
            
              |  |  | 218 |  | 
            
              | 219 |     $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => { | 
            
              | 220 |         suspend => Mojo::JSON->false | 
            
              | 221 |     }); | 
            
              | 222 |     $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); | 
            
              | 223 |     $t->request_ok($tx) | 
            
              | 224 |       ->status_is(200) | 
            
              | 225 |       ->json_is('/reserve_id', $reserve_id3) | 
            
              | 226 |       ->json_is('/suspend', Mojo::JSON->false) | 
            
              | 227 |       ->json_is('/suspend_until', undef); | 
            
              | 228 |  | 
            
              | 229 |     $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => { | 
            
              | 230 |         suspend_until => $suspend_until | 
            
              | 231 |     }); | 
            
              | 232 |     $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); | 
            
              | 233 |     $t->request_ok($tx) | 
            
              | 234 |       ->status_is(200) | 
            
              | 235 |       ->json_is('/reserve_id', $reserve_id3) | 
            
              | 236 |       ->json_is('/suspend', Mojo::JSON->true) | 
            
              | 237 |       ->json_like('/suspend_until', qr/^$suspend_until/); | 
        
          | 218 | }; | 238 | }; | 
        
          | 219 |  | 239 |  | 
        
          | 220 | subtest "Test endpoints with permission" => sub { | 240 | subtest "Test endpoints with permission" => sub { | 
            
              | 221 | -  |  |  |