|
Lines 65-113
$session_nopermission->param('ip', '127.0.0.1');
Link Here
|
| 65 |
$session_nopermission->param('lasttime', time()); |
65 |
$session_nopermission->param('lasttime', time()); |
| 66 |
$session_nopermission->flush; |
66 |
$session_nopermission->flush; |
| 67 |
|
67 |
|
| 68 |
my $borrower = Koha::Patron->new; |
68 |
my $patron_1 = $builder->build_object( |
| 69 |
$borrower->categorycode( $categorycode ); |
69 |
{ |
| 70 |
$borrower->branchcode( $branchcode ); |
70 |
class => 'Koha::Patrons', |
| 71 |
$borrower->surname("Test Surname"); |
71 |
value => { |
| 72 |
$borrower->flags(80); #borrowers and reserveforothers flags |
72 |
categorycode => $categorycode, |
| 73 |
$borrower->userid($nopermission->{ userid }."z"); |
73 |
branchcode => $branchcode, |
| 74 |
$borrower->store; |
74 |
surname => 'Test Surname', |
| 75 |
my $borrowernumber = $borrower->borrowernumber; |
75 |
flags => 80, #borrowers and reserveforothers flags |
| 76 |
|
76 |
} |
| 77 |
my $borrower2 = Koha::Patron->new; |
77 |
} |
| 78 |
$borrower2->categorycode( $categorycode ); |
78 |
); |
| 79 |
$borrower2->branchcode( $branchcode ); |
79 |
|
| 80 |
$borrower2->surname("Test Surname 2"); |
80 |
my $patron_2 = $builder->build_object( |
| 81 |
$borrower2->userid($nopermission->{ userid }."x"); |
81 |
{ |
| 82 |
$borrower2->flags(16); # borrowers flag |
82 |
class => 'Koha::Patrons', |
| 83 |
$borrower2->store; |
83 |
value => { |
| 84 |
my $borrowernumber2 = $borrower2->borrowernumber; |
84 |
categorycode => $categorycode, |
| 85 |
|
85 |
branchcode => $branchcode, |
| 86 |
my $borrower3 = Koha::Patron->new; |
86 |
surname => 'Test Surname 2', |
| 87 |
$borrower3->categorycode( $categorycode ); |
87 |
flags => 16, # borrowers flag |
| 88 |
$borrower3->branchcode( $branchcode ); |
88 |
} |
| 89 |
$borrower3->surname("Test Surname 2"); |
89 |
} |
| 90 |
$borrower3->userid($nopermission->{ userid }."y"); |
90 |
); |
| 91 |
$borrower3->flags(64); # reserveforothers flag |
91 |
|
| 92 |
$borrower3->store; |
92 |
my $patron_3 = $builder->build_object( |
| 93 |
my $borrowernumber3 = $borrower3->borrowernumber; |
93 |
{ |
|
|
94 |
class => 'Koha::Patrons', |
| 95 |
value => { |
| 96 |
categorycode => $categorycode, |
| 97 |
branchcode => $branchcode, |
| 98 |
surname => 'Test Surname 3', |
| 99 |
flags => 64, # reserveforothers flag |
| 100 |
} |
| 101 |
} |
| 102 |
); |
| 94 |
|
103 |
|
| 95 |
# Get sessions |
104 |
# Get sessions |
| 96 |
my $session = C4::Auth::get_session(''); |
105 |
my $session = C4::Auth::get_session(''); |
| 97 |
$session->param('number', $borrower->borrowernumber); |
106 |
$session->param('number', $patron_1->borrowernumber); |
| 98 |
$session->param('id', $borrower->userid); |
107 |
$session->param('id', $patron_1->userid); |
| 99 |
$session->param('ip', '127.0.0.1'); |
108 |
$session->param('ip', '127.0.0.1'); |
| 100 |
$session->param('lasttime', time()); |
109 |
$session->param('lasttime', time()); |
| 101 |
$session->flush; |
110 |
$session->flush; |
| 102 |
my $session2 = C4::Auth::get_session(''); |
111 |
my $session2 = C4::Auth::get_session(''); |
| 103 |
$session2->param('number', $borrower2->borrowernumber); |
112 |
$session2->param('number', $patron_2->borrowernumber); |
| 104 |
$session2->param('id', $borrower2->userid); |
113 |
$session2->param('id', $patron_2->userid); |
| 105 |
$session2->param('ip', '127.0.0.1'); |
114 |
$session2->param('ip', '127.0.0.1'); |
| 106 |
$session2->param('lasttime', time()); |
115 |
$session2->param('lasttime', time()); |
| 107 |
$session2->flush; |
116 |
$session2->flush; |
| 108 |
my $session3 = C4::Auth::get_session(''); |
117 |
my $session3 = C4::Auth::get_session(''); |
| 109 |
$session3->param('number', $borrower3->borrowernumber); |
118 |
$session3->param('number', $patron_3->borrowernumber); |
| 110 |
$session3->param('id', $borrower3->userid); |
119 |
$session3->param('id', $patron_3->userid); |
| 111 |
$session3->param('ip', '127.0.0.1'); |
120 |
$session3->param('ip', '127.0.0.1'); |
| 112 |
$session3->param('lasttime', time()); |
121 |
$session3->param('lasttime', time()); |
| 113 |
$session3->flush; |
122 |
$session3->flush; |
|
Lines 126-143
$dbh->do('DELETE FROM issuingrules');
Link Here
|
| 126 |
VALUES (?, ?, ?, ?) |
135 |
VALUES (?, ?, ?, ?) |
| 127 |
}, {}, '*', '*', '*', 1); |
136 |
}, {}, '*', '*', '*', 1); |
| 128 |
|
137 |
|
| 129 |
my $reserve_id = C4::Reserves::AddReserve($branchcode, $borrowernumber, |
138 |
my $reserve_id = C4::Reserves::AddReserve($branchcode, $patron_1->borrowernumber, |
| 130 |
$biblionumber, undef, 1, undef, undef, undef, '', $itemnumber); |
139 |
$biblionumber, undef, 1, undef, undef, undef, '', $itemnumber); |
| 131 |
|
140 |
|
| 132 |
# Add another reserve to be able to change first reserve's rank |
141 |
# Add another reserve to be able to change first reserve's rank |
| 133 |
my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $borrowernumber2, |
142 |
my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $patron_2->borrowernumber, |
| 134 |
$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber); |
143 |
$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber); |
| 135 |
|
144 |
|
| 136 |
my $suspend_until = DateTime->now->add(days => 10)->ymd; |
145 |
my $suspend_until = DateTime->now->add(days => 10)->ymd; |
| 137 |
my $expirationdate = DateTime->now->add(days => 10)->ymd; |
146 |
my $expirationdate = DateTime->now->add(days => 10)->ymd; |
| 138 |
|
147 |
|
| 139 |
my $post_data = { |
148 |
my $post_data = { |
| 140 |
borrowernumber => int($borrowernumber), |
149 |
borrowernumber => int($patron_1->borrowernumber), |
| 141 |
biblionumber => int($biblionumber), |
150 |
biblionumber => int($biblionumber), |
| 142 |
itemnumber => int($itemnumber), |
151 |
itemnumber => int($itemnumber), |
| 143 |
branchcode => $branchcode, |
152 |
branchcode => $branchcode, |
|
Lines 164-174
subtest "Test endpoints without authentication" => sub {
Link Here
|
| 164 |
subtest "Test endpoints without permission" => sub { |
173 |
subtest "Test endpoints without permission" => sub { |
| 165 |
plan tests => 10; |
174 |
plan tests => 10; |
| 166 |
|
175 |
|
| 167 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber"); |
176 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber); |
| 168 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
177 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 169 |
$t->request_ok($tx) # no permission |
178 |
$t->request_ok($tx) # no permission |
| 170 |
->status_is(403); |
179 |
->status_is(403); |
| 171 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber"); |
180 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber); |
| 172 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
181 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 173 |
$t->request_ok($tx) # reserveforothers permission |
182 |
$t->request_ok($tx) # reserveforothers permission |
| 174 |
->status_is(403); |
183 |
->status_is(403); |
|
Lines 261-273
subtest "Test endpoints with permission" => sub {
Link Here
|
| 261 |
->status_is(404) |
270 |
->status_is(404) |
| 262 |
->json_has('/error'); |
271 |
->json_has('/error'); |
| 263 |
|
272 |
|
| 264 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=".$borrower->borrowernumber); |
273 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber); |
| 265 |
$tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag |
274 |
$tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag |
| 266 |
$t->request_ok($tx) |
275 |
$t->request_ok($tx) |
| 267 |
->status_is(200) |
276 |
->status_is(200) |
| 268 |
->json_is([]); |
277 |
->json_is([]); |
| 269 |
|
278 |
|
| 270 |
my $inexisting_borrowernumber = $borrowernumber2*2; |
279 |
my $inexisting_borrowernumber = $patron_2->borrowernumber * 2; |
| 271 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$inexisting_borrowernumber"); |
280 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$inexisting_borrowernumber"); |
| 272 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
281 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
| 273 |
$t->request_ok($tx) |
282 |
$t->request_ok($tx) |
|
Lines 286-292
subtest "Test endpoints with permission" => sub {
Link Here
|
| 286 |
->json_has('/reserve_id'); |
295 |
->json_has('/reserve_id'); |
| 287 |
$reserve_id = $t->tx->res->json->{reserve_id}; |
296 |
$reserve_id = $t->tx->res->json->{reserve_id}; |
| 288 |
|
297 |
|
| 289 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber"); |
298 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber); |
| 290 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
299 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
| 291 |
$t->request_ok($tx) |
300 |
$t->request_ok($tx) |
| 292 |
->status_is(200) |
301 |
->status_is(200) |
| 293 |
- |
|
|