|
Lines 186-192
subtest "Test endpoints without permission" => sub {
Link Here
|
| 186 |
->status_is(403); |
186 |
->status_is(403); |
| 187 |
}; |
187 |
}; |
| 188 |
subtest "Test endpoints without permission, but accessing own object" => sub { |
188 |
subtest "Test endpoints without permission, but accessing own object" => sub { |
| 189 |
plan tests => 15; |
189 |
plan tests => 25; |
| 190 |
|
190 |
|
| 191 |
my $borrno_tmp = $post_data->{'borrowernumber'}; |
191 |
my $borrno_tmp = $post_data->{'borrowernumber'}; |
| 192 |
$post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'}; |
192 |
$post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'}; |
|
Lines 210-220
subtest "Test endpoints without permission, but accessing own object" => sub {
Link Here
|
| 210 |
my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id; |
210 |
my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id; |
| 211 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data); |
211 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data); |
| 212 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
212 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 213 |
$t->request_ok($tx) # create hold to myself |
213 |
$t->request_ok($tx) |
| 214 |
->status_is(200) |
214 |
->status_is(200) |
| 215 |
->json_is('/reserve_id', $reserve_id3) |
215 |
->json_is('/reserve_id', $reserve_id3) |
| 216 |
->json_is('/suspend_until', $suspend_until . ' 00:00:00') |
216 |
->json_is('/suspend_until', $suspend_until . ' 00:00:00') |
| 217 |
->json_is('/priority', 2); |
217 |
->json_is('/priority', 2); |
|
|
218 |
|
| 219 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => { |
| 220 |
suspend => Mojo::JSON->false |
| 221 |
}); |
| 222 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 223 |
$t->request_ok($tx) |
| 224 |
->status_is(200) |
| 225 |
->json_is('/reserve_id', $reserve_id3) |
| 226 |
->json_is('/suspend', Mojo::JSON->false) |
| 227 |
->json_is('/suspend_until', undef); |
| 228 |
|
| 229 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => { |
| 230 |
suspend_until => $suspend_until |
| 231 |
}); |
| 232 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 233 |
$t->request_ok($tx) |
| 234 |
->status_is(200) |
| 235 |
->json_is('/reserve_id', $reserve_id3) |
| 236 |
->json_is('/suspend', Mojo::JSON->true) |
| 237 |
->json_like('/suspend_until', qr/^$suspend_until/); |
| 218 |
}; |
238 |
}; |
| 219 |
|
239 |
|
| 220 |
subtest "Test endpoints with permission" => sub { |
240 |
subtest "Test endpoints with permission" => sub { |
| 221 |
- |
|
|