| Line 0
          
      
      
        Link Here | 
          
            
              | 0 | -  | 1 | #!/usr/bin/env perl | 
            
              |  |  | 2 |  | 
            
              | 3 | # This file is part of Koha. | 
            
              | 4 | # | 
            
              | 5 | # Koha is free software; you can redistribute it and/or modify it under the | 
            
              | 6 | # terms of the GNU General Public License as published by the Free Software | 
            
              | 7 | # Foundation; either version 3 of the License, or (at your option) any later | 
            
              | 8 | # version. | 
            
              | 9 | # | 
            
              | 10 | # Koha is distributed in the hope that it will be useful, but WITHOUT ANY | 
            
              | 11 | # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR | 
            
              | 12 | # A PARTICULAR PURPOSE.  See the GNU General Public License for more details. | 
            
              | 13 | # | 
            
              | 14 | # You should have received a copy of the GNU General Public License along | 
            
              | 15 | # with Koha; if not, write to the Free Software Foundation, Inc., | 
            
              | 16 | # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 
            
              | 17 |  | 
            
              | 18 | use Modern::Perl; | 
            
              | 19 |  | 
            
              | 20 | use Test::More tests => 1; | 
            
              | 21 | use Test::Mojo; | 
            
              | 22 |  | 
            
              | 23 | use Koha::Database; | 
            
              | 24 |  | 
            
              | 25 | use t::lib::Mocks; | 
            
              | 26 | use t::lib::TestBuilder; | 
            
              | 27 |  | 
            
              | 28 | my $t = Test::Mojo->new('Koha::REST::V1'); | 
            
              | 29 | my $schema  = Koha::Database->new->schema; | 
            
              | 30 | my $builder = t::lib::TestBuilder->new(); | 
            
              | 31 |  | 
            
              | 32 | subtest '/oauth/token tests' => sub { | 
            
              | 33 |     plan tests => 19; | 
            
              | 34 |  | 
            
              | 35 |     $schema->storage->txn_begin; | 
            
              | 36 |  | 
            
              | 37 |     my $patron = $builder->build({ | 
            
              | 38 |         source => 'Borrower', | 
            
              | 39 |         value  => { | 
            
              | 40 |             surname => 'Test OAuth', | 
            
              | 41 |             flags => 0, | 
            
              | 42 |         }, | 
            
              | 43 |     }); | 
            
              | 44 |  | 
            
              | 45 |     # Missing parameter grant_type | 
            
              | 46 |     $t->post_ok('/api/v1/oauth/token') | 
            
              | 47 |         ->status_is(400); | 
            
              | 48 |  | 
            
              | 49 |     # Wrong grant type | 
            
              | 50 |     $t->post_ok('/api/v1/oauth/token', form => { grant_type => 'password' }) | 
            
              | 51 |         ->status_is(400) | 
            
              | 52 |         ->json_is({error => 'Unimplemented grant type'}); | 
            
              | 53 |  | 
            
              | 54 |     # No client_id/client_secret | 
            
              | 55 |     $t->post_ok('/api/v1/oauth/token', form => { grant_type => 'client_credentials' }) | 
            
              | 56 |         ->status_is(403) | 
            
              | 57 |         ->json_is({error => 'unauthorized_client'}); | 
            
              | 58 |  | 
            
              | 59 |     my ($client_id, $client_secret) = ('client1', 'secr3t'); | 
            
              | 60 |     t::lib::Mocks::mock_config('api_client', { | 
            
              | 61 |         'client_id' => $client_id, | 
            
              | 62 |         'client_secret' => $client_secret, | 
            
              | 63 |         patron_id => $patron->{borrowernumber}, | 
            
              | 64 |     }); | 
            
              | 65 |  | 
            
              | 66 |     my $formData = { | 
            
              | 67 |         grant_type => 'client_credentials', | 
            
              | 68 |         client_id => $client_id, | 
            
              | 69 |         client_secret => $client_secret, | 
            
              | 70 |     }; | 
            
              | 71 |     $t->post_ok('/api/v1/oauth/token', form => $formData) | 
            
              | 72 |         ->status_is(200) | 
            
              | 73 |         ->json_is('/expires_in' => 3600) | 
            
              | 74 |         ->json_is('/token_type' => 'Bearer') | 
            
              | 75 |         ->json_has('/access_token'); | 
            
              | 76 |  | 
            
              | 77 |     my $access_token = $t->tx->res->json->{access_token}; | 
            
              | 78 |  | 
            
              | 79 |     # Without access token, it returns 401 | 
            
              | 80 |     $t->get_ok('/api/v1/patrons')->status_is(401); | 
            
              | 81 |  | 
            
              | 82 |     # With access token, but without permissions, it returns 403 | 
            
              | 83 |     my $tx = $t->ua->build_tx(GET => '/api/v1/patrons'); | 
            
              | 84 |     $tx->req->headers->authorization("Bearer $access_token"); | 
            
              | 85 |     $t->request_ok($tx)->status_is(403); | 
            
              | 86 |  | 
            
              | 87 |     # With access token and permissions, it returns 200 | 
            
              | 88 |     $builder->build({ | 
            
              | 89 |         source => 'UserPermission', | 
            
              | 90 |         value  => { | 
            
              | 91 |             borrowernumber => $patron->{borrowernumber}, | 
            
              | 92 |             module_bit => 4, # borrowers | 
            
              | 93 |             code => 'edit_borrowers', | 
            
              | 94 |         }, | 
            
              | 95 |     }); | 
            
              | 96 |     $tx = $t->ua->build_tx(GET => '/api/v1/patrons'); | 
            
              | 97 |     $tx->req->headers->authorization("Bearer $access_token"); | 
            
              | 98 |     $t->request_ok($tx)->status_is(200); | 
            
              | 99 |  | 
            
              | 100 |     $schema->storage->txn_rollback; | 
            
              | 101 | }; |