Attachment #71921 for bug #16330

View | Details | Raw Unified | Return to bug 16330
Collapse All | Expand All




use Mojo::Base 'Mojolicious::Controller';

use C4::Members qw( AddMember ModMember );
use Koha::AuthUtils qw(hash_password);
use Koha::Patrons;
use Koha::Patron::Categories;
use Koha::Patron::Modifications;
use Koha::Libraries;

use Scalar::Util qw(blessed);
use Try::Tiny;

=head1 NAME
    my $c = shift->openapi->valid_input or return;

Koha::REST::V1::Patron

=head1 API

=head2 Methods

=head3 list

Controller function that handles listing Koha::Patron objects

=cut

sub list {
    my $c = shift->openapi->valid_input or return;

    return try {
        my $patrons_set = Koha::Patrons->new;
        my @patrons = $c->objects->search( $patrons_set )->as_list;
        return $c->render( status => 200, openapi => \@patrons );
    }
    catch {
        if ( $_->isa('DBIx::Class::Exception') ) {
            return $c->render( status => 500,
                openapi => { error => $_->{msg} } );
        }
        else {
            return $c->render(
                status  => 500,
                openapi => { error => "Something went wrong, check the logs." }
            );
        }
    };
}

=head3 get

Controller function that handles retrieving a single Koha::Patron object

=cut

sub get {
    my $c = shift->openapi->valid_input or return;


    return $c->render(status => 200, openapi => $patron);
}

=head3 add

Controller function that handles adding a new Koha::Patron object

=cut

sub add {
    my $c = shift->openapi->valid_input or return;

    return try {
        my $body = $c->validation->param('body');

        Koha::Patron->new($body)->_validate;

        # TODO: Use AddMember until it has been moved to Koha-namespace
        my $borrowernumber = AddMember(%$body);
        my $patron         = Koha::Patrons->find($borrowernumber);

        return $c->render( status => 201, openapi => $patron );
    }
    catch {
        unless ( blessed $_ && $_->can('rethrow') ) {
            return $c->render(
                status  => 500,
                openapi => {
                    error => "Something went wrong, check Koha logs for details."
                }
            );
        }
        if ( $_->isa('Koha::Exceptions::Patron::DuplicateObject') ) {
            return $c->render(
                status  => 409,
                openapi => { error => $_->error, conflict => $_->conflict }
            );
        }
        elsif ( $_->isa('Koha::Exceptions::Library::BranchcodeNotFound') ) {
            return $c->render(
                status  => 400,
                openapi => { error => "Given branchcode does not exist" }
            );
        }
        elsif ( $_->isa('Koha::Exceptions::Category::CategorycodeNotFound') ) {
            return $c->render(
                status  => 400,
                openapi => { error => "Given categorycode does not exist" }
            );
        }
        else {
            return $c->render(
                status  => 500,
                openapi => {
                    error => "Something went wrong, check Koha logs for details."
                }
            );
        }
    };
}

=head3 update

Controller function that handles updating a Koha::Patron object

=cut

sub update {
    my $c = shift->openapi->valid_input or return;

    my $patron = Koha::Patrons->find( $c->validation->param('borrowernumber') );

    my $patron;
    return try {
        my $body = $c->validation->param('body');

        $patron->set( _to_model($body) )->_validate;

        # TODO: Use ModMember until it has been moved to Koha-namespace
        if ( ModMember(%$body) ) {
            return $c->render( status => 200, openapi => $patron );
            $user->borrowernumber == $patron->borrowernumber){
            if (C4::Context->preference('OPACPatronDetails')) {
                $body = _delete_unmodifiable_parameters($body);
                die unless $patron->set($body)->_validate;
                my $m = Koha::Patron::Modification->new($body)->store();
                return $c->$cb({}, 202);
            } else {
                return $c->$cb({ error => "You need a permission to change"
                                ." Your personal details"}, 403);
            }
        }
        else {
            return $c->render(
                status  => 500,
                openapi => {
                    error => 'Something went wrong, check Koha logs for details.'
                }
            );
        }
    }
    catch {
        unless ($patron) {
            return $c->render(
                status  => 404,
                openapi => { error => "Patron not found" }
            );
        }
        unless ( blessed $_ && $_->can('rethrow') ) {
            return $c->render(
                status  => 500,
                openapi => {
                    error => "Something went wrong, check Koha logs for details."
                }
            );
        }
        if ( $_->isa('Koha::Exceptions::Patron::DuplicateObject') ) {
            return $c->render(
                status  => 409,
                openapi => { error => $_->error, conflict => $_->conflict }
            );
        }
        elsif ( $_->isa('Koha::Exceptions::Library::BranchcodeNotFound') ) {
            return $c->render(
                status  => 400,
                openapi => { error => "Given branchcode does not exist" }
            );
        }
        elsif ( $_->isa('Koha::Exceptions::Category::CategorycodeNotFound') ) {
            return $c->render(
                status  => 400,
                openapi => { error => "Given categorycode does not exist" }
            );
        }
        elsif ( $_->isa('Koha::Exceptions::MissingParameter') ) {
            return $c->render(
                status  => 400,
                openapi => {
                    error      => "Missing mandatory parameter(s)",
                    parameters => $_->parameter
                }
            );
        }
        elsif ( $_->isa('Koha::Exceptions::BadParameter') ) {
            return $c->render(
                status  => 400,
                openapi => {
                    error      => "Invalid parameter(s)",
                    parameters => $_->parameter
                }
            );
        }
        elsif ( $_->isa('Koha::Exceptions::NoChanges') ) {
            return $c->render(
                status  => 204,
                openapi => { error => "No changes have been made" }
            );
        }
        else {
            return $c->render(
                status  => 500,
                openapi => {
                    error =>
                      "Something went wrong, check Koha logs for details."
                }
            );
        }
    };
}

=head3 delete

Controller function that handles deleting a Koha::Patron object

=cut

sub delete {
    my $c = shift->openapi->valid_input or return;

    my $patron;

    return try {
        $patron = Koha::Patrons->find( $c->validation->param('borrowernumber') );

        # check if loans, reservations, debarrment, etc. before deletion!
        my $res = $patron->delete;
        return $c->render( status => 200, openapi => {} );
        return $c->$cb({}, 200);
    }
    catch {
        unless ($patron) {
            return $c->render(
                status  => 404,
                openapi => { error => "Patron not found" }
            );
        }
        else {
            return $c->render(
                status  => 500,
                openapi => {
                    error =>
                      "Something went wrong, check Koha logs for details."
                }
            );
        }
    };
}

=head3 _to_model
    my ($body) = @_;

Helper function that maps REST api objects into Koha::Patron
attribute names.

=cut

sub _to_model {
    my $params = shift;

    $params->{lost} = ($params->{lost}) ? 1 : 0;
    $params->{gonenoaddress} = ($params->{gonenoaddress}) ? 1 : 0;

    return $params;
}

1;




      "parameters": [{
        "name": "borrowernumber",
        "in": "query",
        "description": "Case insensitive search on borrowernumber",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "cardnumber",
        "in": "query",
        "description": "Case insensitive search on cardnumber",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "surname",
        "in": "query",
        "description": "Case insensitive search on surname",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "firstname",
        "in": "query",
        "description": "Case insensitive search on firstname",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "title",
        "in": "query",
        "description": "Case insensitive search on title",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "othernames",
        "in": "query",
        "description": "Case insensitive search on othernames",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "initials",
        "in": "query",
        "description": "Case insensitive search on initials",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "streetnumber",
        "in": "query",
        "description": "Case insensitive search on streetnumber",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "streettype",
        "in": "query",
        "description": "Case insensitive search on streettype",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "address",
        "in": "query",
        "description": "Case insensitive search on address",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "address2",
        "in": "query",
        "description": "Case insensitive search on address2",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "city",
        "in": "query",
        "description": "Case insensitive search on city",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "state",
        "in": "query",
        "description": "Case insensitive search on state",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "zipcode",
        "in": "query",
        "description": "Case insensitive search on zipcode",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "country",
        "in": "query",
        "description": "Case insensitive search on country",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "email",
        "in": "query",
        "description": "Case insensitive search on email",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "phone",
        "in": "query",
        "description": "Case insensitive search on phone",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "mobile",
        "in": "query",
        "description": "Case insensitive search on mobile",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "fax",
        "in": "query",
        "description": "Case insensitive search on fax",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "emailpro",
        "in": "query",
        "description": "Case insensitive search on emailpro",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "phonepro",
        "in": "query",
        "description": "Case insensitive search on phonepro",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "B_streetnumber",
        "in": "query",
        "description": "Case insensitive search on B_streetnumber",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "B_streettype",
        "in": "query",
        "description": "Case insensitive search on B_streettype",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "B_address",
        "in": "query",
        "description": "Case insensitive search on B_address",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "B_address2",
        "in": "query",
        "description": "Case insensitive search on B_address2",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "B_city",
        "in": "query",
        "description": "Case insensitive search on B_city",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "B_state",
        "in": "query",
        "description": "Case insensitive search on B_state",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "B_zipcode",
        "in": "query",
        "description": "Case insensitive search on B_zipcode",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "B_country",
        "in": "query",
        "description": "Case insensitive search on B_country",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "B_email",
        "in": "query",
        "description": "Case insensitive search on B_email",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "B_phone",
        "in": "query",
        "description": "Case insensitive search on B_phone",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "dateofbirth",
        "in": "query",
        "description": "Case insensitive search on dateofbirth",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "branchcode",
        "in": "query",
        "description": "Case insensitive search on branchcode",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "categorycode",
        "in": "query",
        "description": "Case insensitive search on categorycode",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "dateenrolled",
        "in": "query",
        "description": "Case insensitive search on dateenrolled",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "dateexpiry",
        "in": "query",
        "description": "Case insensitive search on dateexpiry",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "gonenoaddress",
        "in": "query",
        "description": "Search on gonenoaddress",
        "required": false,
        "type": "boolean"
      }, {
      {
        "name": "lost",
        "in": "query",
        "description": "Search on lost",
        "required": false,
        "type": "boolean"
      }, {
      {
        "name": "debarred",
        "in": "query",
        "description": "Case insensitive search on debarred",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "debarredcomment",
        "in": "query",
        "description": "Case insensitive search on debarredcomment",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "contactname",
        "in": "query",
        "description": "Case insensitive search on contactname",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "contactfirstname",
        "in": "query",
        "description": "Case insensitive search on contactfirstname",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "contacttitle",
        "in": "query",
        "description": "Case insensitive search on contacttitle",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "guarantorid",
        "in": "query",
        "description": "Case insensitive search on guarantorid",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "borrowernotes",
        "in": "query",
        "description": "Case insensitive search on borrowernotes",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "relationship",
        "in": "query",
        "description": "Case insensitive search on relationship",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "sex",
        "in": "query",
        "description": "Case insensitive search on sex",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "password",
        "in": "query",
        "description": "Case insensitive search on password",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "flags",
        "in": "query",
        "description": "Case insensitive search on flags",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "userid",
        "in": "query",
        "description": "Case insensitive search on userid",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "opacnote",
        "in": "query",
        "description": "Case insensitive search on opacnote",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "contactnote",
        "in": "query",
        "description": "Case insensitive search on contactnote",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "sort1",
        "in": "query",
        "description": "Case insensitive search on sort1",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "sort2",
        "in": "query",
        "description": "Case insensitive search on sort2",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "altcontactfirstname",
        "in": "query",
        "description": "Case insensitive search on altcontactfirstname",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "altcontactsurname",
        "in": "query",
        "description": "Case insensitive search on altcontactsurname",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "altcontactaddress1",
        "in": "query",
        "description": "Case insensitive search on altcontactaddress1",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "altcontactaddress2",
        "in": "query",
        "description": "Case insensitive search on altcontactaddress2",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "altcontactaddress3",
        "in": "query",
        "description": "Case insensitive search on altcontactaddress3",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "altcontactstate",
        "in": "query",
        "description": "Case insensitive search on altcontactstate",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "altcontactzipcode",
        "in": "query",
        "description": "Case insensitive search on altcontactzipcode",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "altcontactcountry",
        "in": "query",
        "description": "Case insensitive search on altcontactcountry",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "altcontactphone",
        "in": "query",
        "description": "Case insensitive search on altcontactphone",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "smsalertnumber",
        "in": "query",
        "description": "Case insensitive search on smsalertnumber",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "sms_provider_id",
        "in": "query",
        "description": "Case insensitive search on sms_provider_id",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "privacy",
        "in": "query",
        "description": "Case insensitive search on privacy",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "privacy_guarantor_checkouts",
        "in": "query",
        "description": "Case insensitive search on privacy_guarantor_checkouts",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "checkprevcheckout",
        "in": "query",
        "description": "Case insensitive search on checkprevcheckout",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "updated_on",
        "in": "query",
        "description": "Case insensitive search on updated_on",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "lastseen",
        "in": "query",
        "description": "Case insensitive search on lastseen",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "lang",
        "in": "query",
        "description": "Case insensitive search on lang",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "login_attempts",
        "in": "query",
        "description": "Case insensitive search on login_attempts",
        "required": false,
        "type": "string"
      }, {
      {
        "name": "overdrive_auth_token",
        "in": "query",
        "description": "Case insensitive search on overdrive_auth_token",
        "required": false,
        "type": "string"
      }, {
        "$ref": "../parameters.json#/match"
      }, {
        "$ref": "../parameters.json#/order_by"
      }, {
        "$ref": "../parameters.json#/page"
      }, {
        "$ref": "../parameters.json#/per_page"
      }],
      "responses": {
        "200": {

      }
    },
    "post": {
      "x-mojo-to": "Patron#add",
      "operationId": "addPatron",
      "tags": ["patrons"],
      "parameters": [{

            "$ref": "../definitions.json#/error"
          }
        },
        "500": {
          "description": "Internal server error",
          "schema": {
            "$ref": "../definitions.json#/error"
          }
        },
        "503": {
          "description": "Under maintenance",
          "schema": {
            "$ref": "../definitions.json#/error"
          }

      }
    },
    "put": {
      "x-mojo-to": "Patron#update",
      "operationId": "updatePatron",
      "tags": ["patrons"],
      "parameters": [
        {

        }
      },
      "x-koha-authorization": {
        "allow-owner": true,
        "allow-guarantor": true,
        "permissions": {
          "borrowers": "1"
        }
      }
    },
    "delete": {
      "x-mojo-to": "Patron#delete",
      "operationId": "deletePatron",
      "tags": ["patrons"],
      "parameters": [{





use Test::More tests => 5;
use Test::Mojo;
use Test::Warn;

use t::lib::TestBuilder;
use t::lib::Mocks;

use C4::Auth;
use Koha::Cities;
use Koha::Database;

my $schema  = Koha::Database->new->schema;

            authorized => 1 });

        $newpatron->{branchcode} = "nonexistent"; # Test invalid branchcode
        my $tx = $t->ua->build_tx(POST => "/api/v1/patrons" => json => $newpatron );
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
        $t->request_ok($tx)
          ->status_is(400)

    $schema->storage->txn_rollback;
};

subtest 'update() tests' => sub {
    plan tests => 2;

    $schema->storage->txn_begin;

    unauthorized_access_tests('PUT', 123, {email => 'nobody@example.com'});

    subtest 'patron modifying own data' => sub {
        plan tests => 7;

        my ($borrowernumber, $sessionid) = create_user_and_session({
            authorized => 0 });
        my $patron = Koha::Patrons->find($borrowernumber)->TO_JSON;

        t::lib::Mocks::mock_preference("OPACPatronDetails", 0);
        my $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/" .
                            $patron->{borrowernumber} => json => $patron);
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
        $t->request_ok($tx)
          ->status_is(403, 'OPACPatronDetails off - modifications not allowed.');

        t::lib::Mocks::mock_preference("OPACPatronDetails", 1);
        $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/" .
                            $patron->{borrowernumber} => json => $patron);
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
        $t->request_ok($tx)
          ->status_is(204, 'Updating myself with my current data');

        $patron->{'firstname'} = "noob";
        $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/" .
                            $patron->{borrowernumber} => json => $patron);
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
        $t->request_ok($tx)
          ->status_is(202, 'Updating myself with my current data');

        # Approve changes
        Koha::Patron::Modifications->find({
            borrowernumber => $patron->{borrowernumber},
            firstname => "noob"
        })->approve;
        is(Koha::Patrons->find({
            borrowernumber => $patron->{borrowernumber}})->firstname,
           "noob", "Changes approved");
    };

    subtest 'librarian access tests' => sub {
        plan tests => 20;

        t::lib::Mocks::mock_preference('minPasswordLength', 1);
        my ($borrowernumber, $sessionid) = create_user_and_session({ authorized => 1 });
        my ($borrowernumber2, undef) = create_user_and_session({ authorized => 0 });

        my $patron_1  = Koha::Patrons->find($borrowernumber);
        my $patron_2  = Koha::Patrons->find($borrowernumber2);
        my $newpatron = $patron_2->TO_JSON;

        my $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/-1" => json => $newpatron );
                                  json => $newpatron);
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
        $t->request_ok($tx)
          ->status_is(404)
          ->json_has('/error', 'Fails when trying to PUT nonexistent patron');

        $newpatron->{categorycode} = 'nonexistent';
        $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/$borrowernumber2" => json => $newpatron );
                    $newpatron->{borrowernumber} => json => $newpatron
        );
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
        $t->request_ok($tx)
          ->status_is(400)
          ->json_is('/error' => "Given categorycode does not exist");
        $newpatron->{categorycode} = $patron_2->categorycode;

        $newpatron->{branchcode} = 'nonexistent';
        $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/$borrowernumber2" => json => $newpatron );
                    $newpatron->{borrowernumber} => json => $newpatron
        );
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
        $t->request_ok($tx)
          ->status_is(400)
          ->json_is('/error' => "Given branchcode does not exist");
        $newpatron->{branchcode} = $patron_2->branchcode;

        $newpatron->{falseproperty} = "Non existent property";
        $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/$borrowernumber2" => json => $newpatron );
                    $newpatron->{borrowernumber} => json => $newpatron);
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
        $t->request_ok($tx)
          ->status_is(400)

                    'Properties not allowed: falseproperty.');
        delete $newpatron->{falseproperty};

        # Set both cardnumber and userid to already existing values
        $newpatron->{cardnumber} = $patron_1->cardnumber;
        $newpatron->{userid}     = $patron_1->userid;

        $tx = $t->ua->build_tx( PUT => "/api/v1/patrons/$borrowernumber2" => json => $newpatron );
        $tx->req->cookies({ name => 'CGISESSID', value => $sessionid });
        $t->request_ok($tx)->status_is(409)
          ->json_has( '/error' => "Fails when trying to update to an existing cardnumber or userid")
          ->json_is(  '/conflict',
                        {
                            cardnumber => $newpatron->{cardnumber},
                            userid     => $newpatron->{userid}
                        }
          );

        $newpatron->{ cardnumber } = $borrowernumber.$borrowernumber2;
        $newpatron->{ userid } = "user".$borrowernumber.$borrowernumber2;

        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
        $t->request_ok($tx)
          ->status_is(403)
          ->json_has('/required_permissions');
    };
}



    my $args  = shift;
    my $flags = ( $args->{authorized} ) ? 16 : 0;
    my $dbh   = C4::Context->dbh;

    my $user = $builder->build(
        {

                lost => 0,
                email => 'nobody@example.com',
                emailpro => 'nobody@example.com',
                B_email => 'nobody@example.com'
            }
        }
    );
- 

Return to bug 16330

Lines 19-31 use Modern::Perl; Link Here

(-)a/t/db_dependent/api/v1/patrons.t (-77 / +31 lines)
19		19
20	use Test::More tests => 5;	20	use Test::More tests => 5;
21	use Test::Mojo;	21	use Test::Mojo;
22	use Test::Warn;
23		22
24	use t::lib::TestBuilder;	23	use t::lib::TestBuilder;
25	use t::lib::Mocks;	24	use t::lib::Mocks;
26		25
27	use C4::Auth;	26	use C4::Auth;
28	use Koha::Cities;
29	use Koha::Database;	27	use Koha::Database;
30		28
31	my $schema = Koha::Database->new->schema;	29	my $schema = Koha::Database->new->schema;
Lines 168-174 subtest 'add() tests' => sub { Link Here
168	authorized => 1 });	166	authorized => 1 });
169		167
170	$newpatron->{branchcode} = "nonexistent"; # Test invalid branchcode	168	$newpatron->{branchcode} = "nonexistent"; # Test invalid branchcode
171	my $tx = $t->ua->build_tx(POST => "/api/v1/patrons" =>json => $newpatron);	169	my $tx = $t->ua->build_tx(POST => "/api/v1/patrons" => json => $newpatron );
172	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});	170	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});
173	$t->request_ok($tx)	171	$t->request_ok($tx)
174	->status_is(400)	172	->status_is(400)
Lines 216-307 subtest 'add() tests' => sub { Link Here
216	$schema->storage->txn_rollback;	214	$schema->storage->txn_rollback;
217	};	215	};
218		216
219	subtest 'edit() tests' => sub {	217	subtest 'update() tests' => sub {
220	plan tests => 3;	218	plan tests => 2;
221		219
222	$schema->storage->txn_begin;	220	$schema->storage->txn_begin;
223		221
224	unauthorized_access_tests('PUT', 123, {email => 'nobody@example.com'});	222	unauthorized_access_tests('PUT', 123, {email => 'nobody@example.com'});
225		223
226	subtest 'patron modifying own data' => sub {
227	plan tests => 7;
228
229	my ($borrowernumber, $sessionid) = create_user_and_session({
230	authorized => 0 });
231	my $patron = Koha::Patrons->find($borrowernumber)->TO_JSON;
232
233	t::lib::Mocks::mock_preference("OPACPatronDetails", 0);
234	my $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/" .
235	$patron->{borrowernumber} => json => $patron);
236	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});
237	$t->request_ok($tx)
238	->status_is(403, 'OPACPatronDetails off - modifications not allowed.');
239
240	t::lib::Mocks::mock_preference("OPACPatronDetails", 1);
241	$tx = $t->ua->build_tx(PUT => "/api/v1/patrons/" .
242	$patron->{borrowernumber} => json => $patron);
243	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});
244	$t->request_ok($tx)
245	->status_is(204, 'Updating myself with my current data');
246
247	$patron->{'firstname'} = "noob";
248	$tx = $t->ua->build_tx(PUT => "/api/v1/patrons/" .
249	$patron->{borrowernumber} => json => $patron);
250	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});
251	$t->request_ok($tx)
252	->status_is(202, 'Updating myself with my current data');
253
254	# Approve changes
255	Koha::Patron::Modifications->find({
256	borrowernumber => $patron->{borrowernumber},
257	firstname => "noob"
258	})->approve;
259	is(Koha::Patrons->find({
260	borrowernumber => $patron->{borrowernumber}})->firstname,
261	"noob", "Changes approved");
262	};
263
264	subtest 'librarian access tests' => sub {	224	subtest 'librarian access tests' => sub {
265	plan tests => 20;	225	plan tests => 20;
266		226
267	t::lib::Mocks::mock_preference('minPasswordLength', 1);	227	t::lib::Mocks::mock_preference('minPasswordLength', 1);
268	my ($borrowernumber, $sessionid) = create_user_and_session({	228	my ($borrowernumber, $sessionid) = create_user_and_session({ authorized => 1 });
269	authorized => 1 });	229	my ($borrowernumber2, undef) = create_user_and_session({ authorized => 0 });
270	my ($borrowernumber2, undef) = create_user_and_session({	230
271	authorized => 0 });	231	my $patron_1 = Koha::Patrons->find($borrowernumber);
272	my $patron = Koha::Patrons->find($borrowernumber2);	232	my $patron_2 = Koha::Patrons->find($borrowernumber2);
273	my $newpatron = Koha::Patrons->find($borrowernumber2)->TO_JSON;	233	my $newpatron = $patron_2->TO_JSON;
274		234
275	my $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/-1" =>	235	my $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/-1" => json => $newpatron );
276	json => $newpatron);
277	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});	236	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});
278	$t->request_ok($tx)	237	$t->request_ok($tx)
279	->status_is(404)	238	->status_is(404)
280	->json_has('/error', 'Fails when trying to PUT nonexistent patron');	239	->json_has('/error', 'Fails when trying to PUT nonexistent patron');
281		240
282	$newpatron->{categorycode} = 'nonexistent';	241	$newpatron->{categorycode} = 'nonexistent';
283	$tx = $t->ua->build_tx(PUT => "/api/v1/patrons/" .	242	$tx = $t->ua->build_tx(PUT => "/api/v1/patrons/$borrowernumber2" => json => $newpatron );
284	$newpatron->{borrowernumber} => json => $newpatron
285	);
286	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});	243	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});
287	$t->request_ok($tx)	244	$t->request_ok($tx)
288	->status_is(400)	245	->status_is(400)
289	->json_is('/error' => "Given categorycode does not exist");	246	->json_is('/error' => "Given categorycode does not exist");
290	$newpatron->{categorycode} = $patron->categorycode;	247	$newpatron->{categorycode} = $patron_2->categorycode;
291		248
292	$newpatron->{branchcode} = 'nonexistent';	249	$newpatron->{branchcode} = 'nonexistent';
293	$tx = $t->ua->build_tx(PUT => "/api/v1/patrons/" .	250	$tx = $t->ua->build_tx(PUT => "/api/v1/patrons/$borrowernumber2" => json => $newpatron );
294	$newpatron->{borrowernumber} => json => $newpatron
295	);
296	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});	251	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});
297	$t->request_ok($tx)	252	$t->request_ok($tx)
298	->status_is(400)	253	->status_is(400)
299	->json_is('/error' => "Given branchcode does not exist");	254	->json_is('/error' => "Given branchcode does not exist");
300	$newpatron->{branchcode} = $patron->branchcode;	255	$newpatron->{branchcode} = $patron_2->branchcode;
301		256
302	$newpatron->{falseproperty} = "Non existent property";	257	$newpatron->{falseproperty} = "Non existent property";
303	$tx = $t->ua->build_tx(PUT => "/api/v1/patrons/" .	258	$tx = $t->ua->build_tx(PUT => "/api/v1/patrons/$borrowernumber2" => json => $newpatron );
304	$newpatron->{borrowernumber} => json => $newpatron);
305	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});	259	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});
306	$t->request_ok($tx)	260	$t->request_ok($tx)
307	->status_is(400)	261	->status_is(400)
Lines 309-326 subtest 'edit() tests' => sub { Link Here
309	'Properties not allowed: falseproperty.');	263	'Properties not allowed: falseproperty.');
310	delete $newpatron->{falseproperty};	264	delete $newpatron->{falseproperty};
311		265
312	$tx = $t->ua->build_tx(PUT => "/api/v1/patrons/" .	266	# Set both cardnumber and userid to already existing values
313	$borrowernumber => json => $newpatron);	267	$newpatron->{cardnumber} = $patron_1->cardnumber;
314	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});	268	$newpatron->{userid} = $patron_1->userid;
315	$t->request_ok($tx)	269
316	->status_is(409)	270	$tx = $t->ua->build_tx( PUT => "/api/v1/patrons/$borrowernumber2" => json => $newpatron );
317	->json_has('/error' => "Fails when trying to update to an existing"	271	$tx->req->cookies({ name => 'CGISESSID', value => $sessionid });
318	."cardnumber or userid")	272	$t->request_ok($tx)->status_is(409)
319	->json_has('/conflict', {	273	->json_has( '/error' => "Fails when trying to update to an existing cardnumber or userid")
320	cardnumber => $newpatron->{ cardnumber },	274	->json_is( '/conflict',
321	userid => $newpatron->{ userid }	275	{
322	}	276	cardnumber => $newpatron->{cardnumber},
323	);	277	userid => $newpatron->{userid}
		278	}
		279	);
324		280
325	$newpatron->{ cardnumber } = $borrowernumber.$borrowernumber2;	281	$newpatron->{ cardnumber } = $borrowernumber.$borrowernumber2;
326	$newpatron->{ userid } = "user".$borrowernumber.$borrowernumber2;	282	$newpatron->{ userid } = "user".$borrowernumber.$borrowernumber2;
Lines 390-396 sub unauthorized_access_tests { Link Here
390	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});	346	$tx->req->cookies({name => 'CGISESSID', value => $sessionid});
391	$t->request_ok($tx)	347	$t->request_ok($tx)
392	->status_is(403)	348	->status_is(403)
393	->json_is('/required_permissions', {"borrowers" => "1"});	349	->json_has('/required_permissions');
394	};	350	};
395	}	351	}
396		352
Lines 398-404 sub create_user_and_session { Link Here
398		354
399	my $args = shift;	355	my $args = shift;
400	my $flags = ( $args->{authorized} ) ? 16 : 0;	356	my $flags = ( $args->{authorized} ) ? 16 : 0;
401	my $dbh = C4::Context->dbh;
402		357
403	my $user = $builder->build(	358	my $user = $builder->build(
404	{	359	{
Lines 409-415 sub create_user_and_session { Link Here
409	lost => 0,	364	lost => 0,
410	email => 'nobody@example.com',	365	email => 'nobody@example.com',
411	emailpro => 'nobody@example.com',	366	emailpro => 'nobody@example.com',
412	B_email => 'nobody@example.com',	367	B_email => 'nobody@example.com'
413	}	368	}
414	}	369	}
415	);	370	);
416	-

Lines 20-58 use Modern::Perl; Link Here

(-)a/Koha/REST/V1/Patron.pm (-92 / +179 lines)
20	use Mojo::Base 'Mojolicious::Controller';	20	use Mojo::Base 'Mojolicious::Controller';
21		21
22	use C4::Members qw( AddMember ModMember );	22	use C4::Members qw( AddMember ModMember );
23	use Koha::AuthUtils qw(hash_password);
24	use Koha::Patrons;	23	use Koha::Patrons;
25	use Koha::Patron::Categories;
26	use Koha::Patron::Modifications;
27	use Koha::Libraries;
28		24
29	use Scalar::Util qw(blessed);	25	use Scalar::Util qw(blessed);
30	use Try::Tiny;	26	use Try::Tiny;
31		27
32	sub list {	28	=head1 NAME
33	my $c = shift->openapi->valid_input or return;
34		29
		30	Koha::REST::V1::Patron
35		31
36	my $args = $c->req->params->to_hash;	32	=head1 API
37	my $filter = {};	33
38	for my $filter_param ( keys %$args ) {	34	=head2 Methods
39	$filter->{$filter_param} = { LIKE => $args->{$filter_param} . "%" };	35
40	}	36	=head3 list
		37
		38	Controller function that handles listing Koha::Patron objects
		39
		40	=cut
		41
		42	sub list {
		43	my $c = shift->openapi->valid_input or return;
41		44
42	return try {	45	return try {
43	my $patrons = Koha::Patrons->search_limited($filter);	46	my $patrons_set = Koha::Patrons->new;
44	return $c->render(status => 200, openapi => $patrons);	47	my @patrons = $c->objects->search( $patrons_set )->as_list;
		48	return $c->render( status => 200, openapi => \@patrons );
45	}	49	}
46	catch {	50	catch {
47	if ( $_->isa('DBIx::Class::Exception') ) {	51	if ( $_->isa('DBIx::Class::Exception') ) {
48	return $c->render( status => 500, openapi => { error => $_->{msg} } );	52	return $c->render( status => 500,
		53	openapi => { error => $_->{msg} } );
49	}	54	}
50	else {	55	else {
51	return $c->render( status => 500, openapi => { error => "Something went wrong, check the logs." } );	56	return $c->render(
		57	status => 500,
		58	openapi => { error => "Something went wrong, check the logs." }
		59	);
52	}	60	}
53	};	61	};
54	}	62	}
55		63
		64	=head3 get
		65
		66	Controller function that handles retrieving a single Koha::Patron object
		67
		68	=cut
		69
56	sub get {	70	sub get {
57	my $c = shift->openapi->valid_input or return;	71	my $c = shift->openapi->valid_input or return;
58		72
Lines 66-205 sub get { Link Here
66	return $c->render(status => 200, openapi => $patron);	80	return $c->render(status => 200, openapi => $patron);
67	}	81	}
68		82
		83	=head3 add
		84
		85	Controller function that handles adding a new Koha::Patron object
		86
		87	=cut
		88
69	sub add {	89	sub add {
70	my ($c, $args, $cb) = @_;	90	my $c = shift->openapi->valid_input or return;
71		91
72	return try {	92	return try {
73	my $body = $c->req->json;	93	my $body = $c->validation->param('body');
74		94
75	Koha::Patron->new($body)->_validate;	95	Koha::Patron->new($body)->_validate;
		96
76	# TODO: Use AddMember until it has been moved to Koha-namespace	97	# TODO: Use AddMember until it has been moved to Koha-namespace
77	my $borrowernumber = AddMember(%$body);	98	my $borrowernumber = AddMember(%$body);
78	my $patron = Koha::Patrons->find($borrowernumber);	99	my $patron = Koha::Patrons->find($borrowernumber);
79		100
80	return $c->$cb($patron, 201);	101	return $c->render( status => 201, openapi => $patron );
81	}	102	}
82	catch {	103	catch {
83	unless (blessed $_ && $_->can('rethrow')) {	104	unless ( blessed $_ && $_->can('rethrow') ) {
84	return $c->$cb({ error =>	105	return $c->render(
85	"Something went wrong, check Koha logs for details."}, 500);	106	status => 500,
		107	openapi => {
		108	error => "Something went wrong, check Koha logs for details."
		109	}
		110	);
86	}	111	}
87	if ($_->isa('Koha::Exceptions::Patron::DuplicateObject')) {	112	if ( $_->isa('Koha::Exceptions::Patron::DuplicateObject') ) {
88	return $c->$cb({ error => $_->error, conflict => $_->conflict }, 409);	113	return $c->render(
		114	status => 409,
		115	openapi => { error => $_->error, conflict => $_->conflict }
		116	);
89	}	117	}
90	elsif ($_->isa('Koha::Exceptions::Library::BranchcodeNotFound')) {	118	elsif ( $_->isa('Koha::Exceptions::Library::BranchcodeNotFound') ) {
91	return $c->$cb({ error => "Given branchcode does not exist" }, 400);	119	return $c->render(
		120	status => 400,
		121	openapi => { error => "Given branchcode does not exist" }
		122	);
92	}	123	}
93	elsif ($_->isa('Koha::Exceptions::Category::CategorycodeNotFound')) {	124	elsif ( $_->isa('Koha::Exceptions::Category::CategorycodeNotFound') ) {
94	return $c->$cb({ error => "Given categorycode does not exist"}, 400);	125	return $c->render(
		126	status => 400,
		127	openapi => { error => "Given categorycode does not exist" }
		128	);
95	}	129	}
96	else {	130	else {
97	return $c->$cb({ error =>	131	return $c->render(
98	"Something went wrong, check Koha logs for details."}, 500);	132	status => 500,
		133	openapi => {
		134	error => "Something went wrong, check Koha logs for details."
		135	}
		136	);
99	}	137	}
100	};	138	};
101	}	139	}
102		140
103	sub edit {	141	=head3 update
104	my ($c, $args, $cb) = @_;	142
		143	Controller function that handles updating a Koha::Patron object
		144
		145	=cut
		146
		147	sub update {
		148	my $c = shift->openapi->valid_input or return;
		149
		150	my $patron = Koha::Patrons->find( $c->validation->param('borrowernumber') );
105		151
106	my $patron;
107	return try {	152	return try {
108	my $user = $c->stash('koha.user');	153	my $body = $c->validation->param('body');
109	$patron = Koha::Patrons->find($args->{borrowernumber});	154
110	my $body = $c->req->json;	155	$patron->set( _to_model($body) )->_validate;
111		156
112	$body->{borrowernumber} = $args->{borrowernumber};	157	# TODO: Use ModMember until it has been moved to Koha-namespace
113		158	if ( ModMember(%$body) ) {
114	if (!C4::Auth::haspermission($user->userid, { borrowers => 1 }) &&	159	return $c->render( status => 200, openapi => $patron );
115	$user->borrowernumber == $patron->borrowernumber){
116	if (C4::Context->preference('OPACPatronDetails')) {
117	$body = _delete_unmodifiable_parameters($body);
118	die unless $patron->set($body)->_validate;
119	my $m = Koha::Patron::Modification->new($body)->store();
120	return $c->$cb({}, 202);
121	} else {
122	return $c->$cb({ error => "You need a permission to change"
123	." Your personal details"}, 403);
124	}
125	}	160	}
126	else {	161	else {
127	delete $body->{borrowernumber};	162	return $c->render(
128	die unless $patron->set($body)->_validate;	163	status => 500,
129	# TODO: Use ModMember until it has been moved to Koha-namespace	164	openapi => {
130	$body->{borrowernumber} = $args->{borrowernumber};	165	error => 'Something went wrong, check Koha logs for details.'
131	die unless ModMember(%$body);	166	}
132	return $c->$cb($patron, 200);	167	);
133	}	168	}
134	}	169	}
135	catch {	170	catch {
136	unless ($patron) {	171	unless ($patron) {
137	return $c->$cb({error => "Patron not found"}, 404);	172	return $c->render(
		173	status => 404,
		174	openapi => { error => "Patron not found" }
		175	);
138	}	176	}
139	unless (blessed $_ && $_->can('rethrow')) {	177	unless ( blessed $_ && $_->can('rethrow') ) {
140	return $c->$cb({ error =>	178	return $c->render(
141	"Something went wrong, check Koha logs for details."}, 500);	179	status => 500,
		180	openapi => {
		181	error => "Something went wrong, check Koha logs for details."
		182	}
		183	);
142	}	184	}
143	if ($_->isa('Koha::Exceptions::Patron::DuplicateObject')) {	185	if ( $_->isa('Koha::Exceptions::Patron::DuplicateObject') ) {
144	return $c->$cb({ error => $_->error, conflict => $_->conflict }, 409);	186	return $c->render(
		187	status => 409,
		188	openapi => { error => $_->error, conflict => $_->conflict }
		189	);
145	}	190	}
146	elsif ($_->isa('Koha::Exceptions::Library::BranchcodeNotFound')) {	191	elsif ( $_->isa('Koha::Exceptions::Library::BranchcodeNotFound') ) {
147	return $c->$cb({ error => "Given branchcode does not exist" }, 400);	192	return $c->render(
		193	status => 400,
		194	openapi => { error => "Given branchcode does not exist" }
		195	);
148	}	196	}
149	elsif ($_->isa('Koha::Exceptions::Category::CategorycodeNotFound')) {	197	elsif ( $_->isa('Koha::Exceptions::Category::CategorycodeNotFound') ) {
150	return $c->$cb({ error => "Given categorycode does not exist"}, 400);	198	return $c->render(
		199	status => 400,
		200	openapi => { error => "Given categorycode does not exist" }
		201	);
151	}	202	}
152	elsif ($_->isa('Koha::Exceptions::MissingParameter')) {	203	elsif ( $_->isa('Koha::Exceptions::MissingParameter') ) {
153	return $c->$cb({error => "Missing mandatory parameter(s)",	204	return $c->render(
154	parameters => $_->parameter }, 400);	205	status => 400,
		206	openapi => {
		207	error => "Missing mandatory parameter(s)",
		208	parameters => $_->parameter
		209	}
		210	);
155	}	211	}
156	elsif ($_->isa('Koha::Exceptions::BadParameter')) {	212	elsif ( $_->isa('Koha::Exceptions::BadParameter') ) {
157	return $c->$cb({error => "Invalid parameter(s)",	213	return $c->render(
158	parameters => $_->parameter }, 400);	214	status => 400,
		215	openapi => {
		216	error => "Invalid parameter(s)",
		217	parameters => $_->parameter
		218	}
		219	);
159	}	220	}
160	elsif ($_->isa('Koha::Exceptions::NoChanges')) {	221	elsif ( $_->isa('Koha::Exceptions::NoChanges') ) {
161	return $c->$cb({error => "No changes have been made"}, 204);	222	return $c->render(
		223	status => 204,
		224	openapi => { error => "No changes have been made" }
		225	);
162	}	226	}
163	else {	227	else {
164	return $c->$cb({ error =>	228	return $c->render(
165	"Something went wrong, check Koha logs for details."}, 500);	229	status => 500,
		230	openapi => {
		231	error =>
		232	"Something went wrong, check Koha logs for details."
		233	}
		234	);
166	}	235	}
167	};	236	};
168	}	237	}
169		238
		239	=head3 delete
		240
		241	Controller function that handles deleting a Koha::Patron object
		242
		243	=cut
		244
170	sub delete {	245	sub delete {
171	my ($c, $args, $cb) = @_;	246	my $c = shift->openapi->valid_input or return;
172		247
173	my $patron;	248	my $patron;
174		249
175	return try {	250	return try {
176	$patron = Koha::Patrons->find($args->{borrowernumber});	251	$patron = Koha::Patrons->find( $c->validation->param('borrowernumber') );
		252
177	# check if loans, reservations, debarrment, etc. before deletion!	253	# check if loans, reservations, debarrment, etc. before deletion!
178	my $res = $patron->delete;	254	my $res = $patron->delete;
179		255	return $c->render( status => 200, openapi => {} );
180	return $c->$cb({}, 200);
181	}	256	}
182	catch {	257	catch {
183	unless ($patron) {	258	unless ($patron) {
184	return $c->$cb({error => "Patron not found"}, 404);	259	return $c->render(
		260	status => 404,
		261	openapi => { error => "Patron not found" }
		262	);
185	}	263	}
186	else {	264	else {
187	return $c->$cb({ error =>	265	return $c->render(
188	"Something went wrong, check Koha logs for details."}, 500);	266	status => 500,
		267	openapi => {
		268	error =>
		269	"Something went wrong, check Koha logs for details."
		270	}
		271	);
189	}	272	}
190	};	273	};
191	}	274	}
192		275
193	sub _delete_unmodifiable_parameters {	276	=head3 _to_model
194	my ($body) = @_;
195		277
196	my %columns = map { $_ => 1 } Koha::Patron::Modifications->columns;	278	Helper function that maps REST api objects into Koha::Patron
197	foreach my $param (keys %$body) {	279	attribute names.
198	unless (exists $columns{$param}) {	280
199	delete $body->{$param};	281	=cut
200	}	282
201	}	283	sub _to_model {
202	return $body;	284	my $params = shift;
		285
		286	$params->{lost} = ($params->{lost}) ? 1 : 0;
		287	$params->{gonenoaddress} = ($params->{gonenoaddress}) ? 1 : 0;
		288
		289	return $params;
203	}	290	}
204		291
205	1;	292	1;