Attachment #67578 for bug #19405

View | Details | Raw Unified | Return to bug 19405
Collapse All | Expand All




$session_nopermission->param('lasttime', time());
$session_nopermission->flush;

my $patron_1 = $builder->build_object(
    {
        class => 'Koha::Patrons',
        value => {
            categorycode => $categorycode,
            branchcode   => $branchcode,
            surname      => 'Test Surname',
            flags        => 80, #borrowers and reserveforothers flags
        }
    }
);

my $patron_2 = $builder->build_object(
    {
        class => 'Koha::Patrons',
        value => {
            categorycode => $categorycode,
            branchcode   => $branchcode,
            surname      => 'Test Surname 2',
            flags        => 16, # borrowers flag
        }
    }
);

my $patron_3 = $builder->build_object(
    {
        class => 'Koha::Patrons',
        value => {
            categorycode => $categorycode,
            branchcode   => $branchcode,
            surname      => 'Test Surname 3',
            flags        => 64, # reserveforothers flag
        }
    }
);

# Get sessions
my $session = C4::Auth::get_session('');
$session->param('number', $patron_1->borrowernumber);
$session->param('id', $patron_1->userid);
$session->param('ip', '127.0.0.1');
$session->param('lasttime', time());
$session->flush;
my $session2 = C4::Auth::get_session('');
$session2->param('number', $patron_2->borrowernumber);
$session2->param('id', $patron_2->userid);
$session2->param('ip', '127.0.0.1');
$session2->param('lasttime', time());
$session2->flush;
my $session3 = C4::Auth::get_session('');
$session3->param('number', $patron_3->borrowernumber);
$session3->param('id', $patron_3->userid);
$session3->param('ip', '127.0.0.1');
$session3->param('lasttime', time());
$session3->flush;

        VALUES (?, ?, ?, ?)
    }, {}, '*', '*', '*', 1);

my $reserve_id = C4::Reserves::AddReserve($branchcode, $patron_1->borrowernumber,
    $biblionumber, undef, 1, undef, undef, undef, '', $itemnumber);

# Add another reserve to be able to change first reserve's rank
my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $patron_2->borrowernumber,
    $biblionumber, undef, 2, undef, undef, undef, '', $itemnumber);

my $suspend_until = DateTime->now->add(days => 10)->ymd;
my $expirationdate = DateTime->now->add(days => 10)->ymd;

my $post_data = {
    borrowernumber => int($patron_1->borrowernumber),
    biblionumber => int($biblionumber),
    itemnumber => int($itemnumber),
    branchcode => $branchcode,

subtest "Test endpoints without permission" => sub {
    plan tests => 10;

    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
    $t->request_ok($tx) # no permission
      ->status_is(403);
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
    $t->request_ok($tx) # reserveforothers permission
      ->status_is(403);

      ->status_is(404)
      ->json_has('/error');

    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
    $tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag
    $t->request_ok($tx)
      ->status_is(200)
      ->json_is([]);

    my $inexisting_borrowernumber = $patron_2->borrowernumber * 2;
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$inexisting_borrowernumber");
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
    $t->request_ok($tx)

      ->json_has('/reserve_id');
    $reserve_id = $t->tx->res->json->{reserve_id};

    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
    $t->request_ok($tx)
      ->status_is(200)
- 

Return to bug 19405

Lines 65-113 $session_nopermission->param('ip', '127.0.0.1'); Link Here

(-)a/t/db_dependent/api/v1/holds.t (-41 / +49 lines)
65	$session_nopermission->param('lasttime', time());	65	$session_nopermission->param('lasttime', time());
66	$session_nopermission->flush;	66	$session_nopermission->flush;
67		67
68	my $borrower = Koha::Patron->new;	68	my $patron_1 = $builder->build_object(
69	$borrower->categorycode( $categorycode );	69	{
70	$borrower->branchcode( $branchcode );	70	class => 'Koha::Patrons',
71	$borrower->surname("Test Surname");	71	value => {
72	$borrower->flags(80); #borrowers and reserveforothers flags	72	categorycode => $categorycode,
73	$borrower->userid($nopermission->{ userid }."z");	73	branchcode => $branchcode,
74	$borrower->store;	74	surname => 'Test Surname',
75	my $borrowernumber = $borrower->borrowernumber;	75	flags => 80, #borrowers and reserveforothers flags
76		76	}
77	my $borrower2 = Koha::Patron->new;	77	}
78	$borrower2->categorycode( $categorycode );	78	);
79	$borrower2->branchcode( $branchcode );	79
80	$borrower2->surname("Test Surname 2");	80	my $patron_2 = $builder->build_object(
81	$borrower2->userid($nopermission->{ userid }."x");	81	{
82	$borrower2->flags(16); # borrowers flag	82	class => 'Koha::Patrons',
83	$borrower2->store;	83	value => {
84	my $borrowernumber2 = $borrower2->borrowernumber;	84	categorycode => $categorycode,
85		85	branchcode => $branchcode,
86	my $borrower3 = Koha::Patron->new;	86	surname => 'Test Surname 2',
87	$borrower3->categorycode( $categorycode );	87	flags => 16, # borrowers flag
88	$borrower3->branchcode( $branchcode );	88	}
89	$borrower3->surname("Test Surname 2");	89	}
90	$borrower3->userid($nopermission->{ userid }."y");	90	);
91	$borrower3->flags(64); # reserveforothers flag	91
92	$borrower3->store;	92	my $patron_3 = $builder->build_object(
93	my $borrowernumber3 = $borrower3->borrowernumber;	93	{
		94	class => 'Koha::Patrons',
		95	value => {
		96	categorycode => $categorycode,
		97	branchcode => $branchcode,
		98	surname => 'Test Surname 3',
		99	flags => 64, # reserveforothers flag
		100	}
		101	}
		102	);
94		103
95	# Get sessions	104	# Get sessions
96	my $session = C4::Auth::get_session('');	105	my $session = C4::Auth::get_session('');
97	$session->param('number', $borrower->borrowernumber);	106	$session->param('number', $patron_1->borrowernumber);
98	$session->param('id', $borrower->userid);	107	$session->param('id', $patron_1->userid);
99	$session->param('ip', '127.0.0.1');	108	$session->param('ip', '127.0.0.1');
100	$session->param('lasttime', time());	109	$session->param('lasttime', time());
101	$session->flush;	110	$session->flush;
102	my $session2 = C4::Auth::get_session('');	111	my $session2 = C4::Auth::get_session('');
103	$session2->param('number', $borrower2->borrowernumber);	112	$session2->param('number', $patron_2->borrowernumber);
104	$session2->param('id', $borrower2->userid);	113	$session2->param('id', $patron_2->userid);
105	$session2->param('ip', '127.0.0.1');	114	$session2->param('ip', '127.0.0.1');
106	$session2->param('lasttime', time());	115	$session2->param('lasttime', time());
107	$session2->flush;	116	$session2->flush;
108	my $session3 = C4::Auth::get_session('');	117	my $session3 = C4::Auth::get_session('');
109	$session3->param('number', $borrower3->borrowernumber);	118	$session3->param('number', $patron_3->borrowernumber);
110	$session3->param('id', $borrower3->userid);	119	$session3->param('id', $patron_3->userid);
111	$session3->param('ip', '127.0.0.1');	120	$session3->param('ip', '127.0.0.1');
112	$session3->param('lasttime', time());	121	$session3->param('lasttime', time());
113	$session3->flush;	122	$session3->flush;
Lines 126-143 $dbh->do('DELETE FROM issuingrules'); Link Here
126	VALUES (?, ?, ?, ?)	135	VALUES (?, ?, ?, ?)
127	}, {}, '', '', '*', 1);	136	}, {}, '', '', '*', 1);
128		137
129	my $reserve_id = C4::Reserves::AddReserve($branchcode, $borrowernumber,	138	my $reserve_id = C4::Reserves::AddReserve($branchcode, $patron_1->borrowernumber,
130	$biblionumber, undef, 1, undef, undef, undef, '', $itemnumber);	139	$biblionumber, undef, 1, undef, undef, undef, '', $itemnumber);
131		140
132	# Add another reserve to be able to change first reserve's rank	141	# Add another reserve to be able to change first reserve's rank
133	my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $borrowernumber2,	142	my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $patron_2->borrowernumber,
134	$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber);	143	$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber);
135		144
136	my $suspend_until = DateTime->now->add(days => 10)->ymd;	145	my $suspend_until = DateTime->now->add(days => 10)->ymd;
137	my $expirationdate = DateTime->now->add(days => 10)->ymd;	146	my $expirationdate = DateTime->now->add(days => 10)->ymd;
138		147
139	my $post_data = {	148	my $post_data = {
140	borrowernumber => int($borrowernumber),	149	borrowernumber => int($patron_1->borrowernumber),
141	biblionumber => int($biblionumber),	150	biblionumber => int($biblionumber),
142	itemnumber => int($itemnumber),	151	itemnumber => int($itemnumber),
143	branchcode => $branchcode,	152	branchcode => $branchcode,
Lines 164-174 subtest "Test endpoints without authentication" => sub { Link Here
164	subtest "Test endpoints without permission" => sub {	173	subtest "Test endpoints without permission" => sub {
165	plan tests => 10;	174	plan tests => 10;
166		175
167	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber");	176	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
168	$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});	177	$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
169	$t->request_ok($tx) # no permission	178	$t->request_ok($tx) # no permission
170	->status_is(403);	179	->status_is(403);
171	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber");	180	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
172	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});	181	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});
173	$t->request_ok($tx) # reserveforothers permission	182	$t->request_ok($tx) # reserveforothers permission
174	->status_is(403);	183	->status_is(403);
Lines 261-273 subtest "Test endpoints with permission" => sub { Link Here
261	->status_is(404)	270	->status_is(404)
262	->json_has('/error');	271	->json_has('/error');
263		272
264	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=".$borrower->borrowernumber);	273	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
265	$tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag	274	$tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag
266	$t->request_ok($tx)	275	$t->request_ok($tx)
267	->status_is(200)	276	->status_is(200)
268	->json_is([]);	277	->json_is([]);
269		278
270	my $inexisting_borrowernumber = $borrowernumber2*2;	279	my $inexisting_borrowernumber = $patron_2->borrowernumber * 2;
271	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$inexisting_borrowernumber");	280	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$inexisting_borrowernumber");
272	$tx->req->cookies({name => 'CGISESSID', value => $session->id});	281	$tx->req->cookies({name => 'CGISESSID', value => $session->id});
273	$t->request_ok($tx)	282	$t->request_ok($tx)
Lines 286-292 subtest "Test endpoints with permission" => sub { Link Here
286	->json_has('/reserve_id');	295	->json_has('/reserve_id');
287	$reserve_id = $t->tx->res->json->{reserve_id};	296	$reserve_id = $t->tx->res->json->{reserve_id};
288		297
289	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$borrowernumber");	298	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
290	$tx->req->cookies({name => 'CGISESSID', value => $session->id});	299	$tx->req->cookies({name => 'CGISESSID', value => $session->id});
291	$t->request_ok($tx)	300	$t->request_ok($tx)
292	->status_is(200)	301	->status_is(200)
293	-