Attachment #83683 for bug #21198

View | Details | Raw Unified | Return to bug 21198
Collapse All | Expand All




# [1] https://metacpan.org/source/CGI::Session::Driver::DBI#L28
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );

subtest 'stash the user' => sub {

    subtest 'token-based tests' => sub {
        plan tests => 10;
    }
    else {
        plan skip_all => 'Net::OAuth2::AuthorizationServer not available';
    }

        if ( can_load( modules => { 'Net::OAuth2::AuthorizationServer' => undef } ) ) {
            plan tests => 10;
        }
        else {
            plan skip_all => 'Net::OAuth2::AuthorizationServer not available';
        }

        $schema->storage->txn_begin;

        my $patron = $builder->build_object({
            class => 'Koha::Patrons',
            value  => {
                flags => 16 # no permissions
            },
        });

        t::lib::Mocks::mock_preference('RESTOAuth2ClientCredentials', 1);

        my $api_key = Koha::ApiKey->new({ patron_id => $patron->id, description => 'blah' })->store;

        my $formData = {
            grant_type    => 'client_credentials',
            client_id     => $api_key->client_id,
            client_secret => $api_key->secret
        };
        $t->post_ok('/api/v1/oauth/token', form => $formData)
            ->status_is(200)
            ->json_is('/expires_in' => 3600)
            ->json_is('/token_type' => 'Bearer')
            ->json_has('/access_token');

        my $access_token = $t->tx->res->json->{access_token};

        my $stash;

        my $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
        $tx->req->headers->authorization("Bearer $access_token");
        value  => {
            flags => 16 # no permissions
        },
    });

        $t->app->hook(after_dispatch => sub { $stash = shift->stash });
        $t->request_ok($tx)->status_is(200);

        my $user = $stash->{'koha.user'};
        ok( defined $user, 'The \'koha.user\' object is defined in the stash') and
        is( ref($user), 'Koha::Patron', 'Stashed koha.user object type is Koha::Patron') and
        is( $user->borrowernumber, $patron->borrowernumber, 'The stashed user is the right one' );

        $schema->storage->txn_rollback;
        grant_type    => 'client_credentials',
        client_id     => $api_key->client_id,
        client_secret => $api_key->secret
    };
    $t->post_ok('/api/v1/oauth/token', form => $formData)
        ->status_is(200)
        ->json_is('/expires_in' => 3600)
        ->json_is('/token_type' => 'Bearer')
        ->json_has('/access_token');

    subtest 'cookie-based tests' => sub {

        plan tests => 5;
    #$patron->flags(2**4)->store;

        $schema->storage->txn_begin;

        my ( $patron, $session_id ) = create_user_and_session({ authorized => 1 });
    $tx->req->headers->authorization("Bearer $access_token");

        $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
        $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
        $tx->req->env( { REMOTE_ADDR => $remote_address } );

        my $stash;
        $t->app->hook(after_dispatch => sub { $stash = shift->stash });
        $t->request_ok($tx)->status_is(200);
    is( $user->borrowernumber, $patron->borrowernumber, 'The stashed user is the right one' );

        my $user = $stash->{'koha.user'};
        ok( defined $user, 'The \'koha.user\' object is defined in the stash') and
        is( ref($user), 'Koha::Patron', 'Stashed koha.user object type is Koha::Patron') and
        is( $user->borrowernumber, $patron->borrowernumber, 'The stashed user is the right one' );

        $schema->storage->txn_rollback;
    };
};

subtest 'stash the reason the user was granted access' => sub {

    plan tests => 12;

    $schema->storage->txn_begin;

    my ( $patron, $session_id ) = create_user_and_session({ authorized => 0 });

    my ( $stash, $reason );

    my $other_patron = $builder->build_object({ class => 'Koha::Patrons' });

    $tx = $t->ua->build_tx( GET => "/api/v1/patrons/" . $other_patron->borrowernumber );
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
    $tx->req->env( { REMOTE_ADDR => $remote_address } );

    $t->app->hook(after_dispatch => sub { $stash = shift->stash });
    $t->request_ok($tx)->status_is(403);

    $reason = $stash->{'grant_reason'};
    is( $reason, undef, "no grant_reason is stashed when no permissions" );

    $tx = $t->ua->build_tx( GET => "/api/v1/patrons/" . $patron->borrowernumber );
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
    $tx->req->env( { REMOTE_ADDR => $remote_address } );

    $t->app->hook(after_dispatch => sub { $stash = shift->stash });
    $t->request_ok($tx)->status_is(200);

    $reason = $stash->{'grant_reason'};
    is( $reason, 'owner', "grant_reason is 'owner'" );

    my $guarantee = $builder->build_object({ class => 'Koha::Patrons', value => { guarantorid => $patron->borrowernumber } });

    $tx = $t->ua->build_tx( GET => "/api/v1/patrons/" . $guarantee->borrowernumber );
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
    $tx->req->env( { REMOTE_ADDR => $remote_address } );

    $t->app->hook(after_dispatch => sub { $stash = shift->stash });
    $t->request_ok($tx)->status_is(200);

    $reason = $stash->{'grant_reason'};
    is( $reason, 'guarantor', "grant_reason is 'guarantor'" );

    $patron->flags(2**4)->store; #

    $tx = $t->ua->build_tx( GET => "/api/v1/patrons/" . $guarantee->borrowernumber );
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
    $tx->req->env( { REMOTE_ADDR => $remote_address } );

    my $stash;
    $t->app->hook(after_dispatch => sub { $stash = shift->stash });
    $t->request_ok($tx)->status_is(200);

    $reason = $stash->{'grant_reason'};
    is( $reason, 'permissions', "grant_reason is 'permissions'" );
    is( ref($user), 'Koha::Patron', 'Stashed koha.user object type is Koha::Patron') and
    is( $user->borrowernumber, $borrowernumber, 'The stashed user is the right one' );

    $schema->storage->txn_rollback;
};

    my $args  = shift;
    my $flags = ( $args->{authorized} ) ? 16 : 0;

    my $patron = $builder->build_object(
        {
            class => 'Koha::Patrons',
            value => {
                flags => $flags
            }
        }


    # Create a session for the authorized user
    my $session = C4::Auth::get_session('');
    $session->param( 'number',   $patron->borrowernumber );
    $session->param( 'id',       $patron->userid );
    $session->param( 'ip',       '127.0.0.1' );
    $session->param( 'lasttime', time() );
    $session->flush;

    return ( $patron, $session->id );
}
- 

Return to bug 21198

Lines 41-120 my $tx; Link Here

(-)a/t/db_dependent/api/v1/auth_authenticate_api_request.t (-54 / +112 lines)
41	# [1] https://metacpan.org/source/CGI::Session::Driver::DBI#L28	41	# [1] https://metacpan.org/source/CGI::Session::Driver::DBI#L28
42	t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );	42	t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
43		43
44	subtest 'token-based tests' => sub {	44	subtest 'stash the user' => sub {
45		45
46	if ( can_load( modules => { 'Net::OAuth2::AuthorizationServer' => undef } ) ) {	46	subtest 'token-based tests' => sub {
47	plan tests => 10;
48	}
49	else {
50	plan skip_all => 'Net::OAuth2::AuthorizationServer not available';
51	}
52		47
53	$schema->storage->txn_begin;	48	if ( can_load( modules => { 'Net::OAuth2::AuthorizationServer' => undef } ) ) {
		49	plan tests => 10;
		50	}
		51	else {
		52	plan skip_all => 'Net::OAuth2::AuthorizationServer not available';
		53	}
		54
		55	$schema->storage->txn_begin;
		56
		57	my $patron = $builder->build_object({
		58	class => 'Koha::Patrons',
		59	value => {
		60	flags => 16 # no permissions
		61	},
		62	});
		63
		64	t::lib::Mocks::mock_preference('RESTOAuth2ClientCredentials', 1);
		65
		66	my $api_key = Koha::ApiKey->new({ patron_id => $patron->id, description => 'blah' })->store;
		67
		68	my $formData = {
		69	grant_type => 'client_credentials',
		70	client_id => $api_key->client_id,
		71	client_secret => $api_key->secret
		72	};
		73	$t->post_ok('/api/v1/oauth/token', form => $formData)
		74	->status_is(200)
		75	->json_is('/expires_in' => 3600)
		76	->json_is('/token_type' => 'Bearer')
		77	->json_has('/access_token');
		78
		79	my $access_token = $t->tx->res->json->{access_token};
		80
		81	my $stash;
54		82
55	my $patron = $builder->build_object({	83	my $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
56	class => 'Koha::Patrons',	84	$tx->req->headers->authorization("Bearer $access_token");
57	value => {
58	flags => 16 # no permissions
59	},
60	});
61		85
62	t::lib::Mocks::mock_preference('RESTOAuth2ClientCredentials', 1);	86	$t->app->hook(after_dispatch => sub { $stash = shift->stash });
		87	$t->request_ok($tx)->status_is(200);
63		88
64	my $api_key = Koha::ApiKey->new({ patron_id => $patron->id, description => 'blah' })->store;	89	my $user = $stash->{'koha.user'};
		90	ok( defined $user, 'The \'koha.user\' object is defined in the stash') and
		91	is( ref($user), 'Koha::Patron', 'Stashed koha.user object type is Koha::Patron') and
		92	is( $user->borrowernumber, $patron->borrowernumber, 'The stashed user is the right one' );
65		93
66	my $formData = {	94	$schema->storage->txn_rollback;
67	grant_type => 'client_credentials',
68	client_id => $api_key->client_id,
69	client_secret => $api_key->secret
70	};	95	};
71	$t->post_ok('/api/v1/oauth/token', form => $formData)
72	->status_is(200)
73	->json_is('/expires_in' => 3600)
74	->json_is('/token_type' => 'Bearer')
75	->json_has('/access_token');
76		96
77	my $access_token = $t->tx->res->json->{access_token};	97	subtest 'cookie-based tests' => sub {
78		98
79	# With access token and permissions, it returns 200	99	plan tests => 5;
80	#$patron->flags(2**4)->store;
81		100
82	my $stash;	101	$schema->storage->txn_begin;
83		102
84	my $tx = $t->ua->build_tx(GET => '/api/v1/patrons');	103	my ( $patron, $session_id ) = create_user_and_session({ authorized => 1 });
85	$tx->req->headers->authorization("Bearer $access_token");
86		104
87	$t->app->hook(after_dispatch => sub { $stash = shift->stash });	105	$tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
88	$t->request_ok($tx)->status_is(200);	106	$tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
		107	$tx->req->env( { REMOTE_ADDR => $remote_address } );
89		108
90	my $user = $stash->{'koha.user'};	109	my $stash;
91	ok( defined $user, 'The \'koha.user\' object is defined in the stash') and	110	$t->app->hook(after_dispatch => sub { $stash = shift->stash });
92	is( ref($user), 'Koha::Patron', 'Stashed koha.user object type is Koha::Patron') and	111	$t->request_ok($tx)->status_is(200);
93	is( $user->borrowernumber, $patron->borrowernumber, 'The stashed user is the right one' );
94		112
95	$schema->storage->txn_rollback;	113	my $user = $stash->{'koha.user'};
		114	ok( defined $user, 'The \'koha.user\' object is defined in the stash') and
		115	is( ref($user), 'Koha::Patron', 'Stashed koha.user object type is Koha::Patron') and
		116	is( $user->borrowernumber, $patron->borrowernumber, 'The stashed user is the right one' );
		117
		118	$schema->storage->txn_rollback;
		119	};
96	};	120	};
97		121
98	subtest 'cookie-based tests' => sub {	122	subtest 'stash the reason the user was granted access' => sub {
99		123
100	plan tests => 5;	124	plan tests => 12;
101		125
102	$schema->storage->txn_begin;	126	$schema->storage->txn_begin;
103		127
104	my ( $borrowernumber, $session_id ) = create_user_and_session({ authorized => 1 });	128	my ( $patron, $session_id ) = create_user_and_session({ authorized => 0 });
105		129
106	$tx = $t->ua->build_tx( GET => "/api/v1/patrons" );	130	my ( $stash, $reason );
		131
		132	my $other_patron = $builder->build_object({ class => 'Koha::Patrons' });
		133
		134	$tx = $t->ua->build_tx( GET => "/api/v1/patrons/" . $other_patron->borrowernumber );
		135	$tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
		136	$tx->req->env( { REMOTE_ADDR => $remote_address } );
		137
		138	$t->app->hook(after_dispatch => sub { $stash = shift->stash });
		139	$t->request_ok($tx)->status_is(403);
		140
		141	$reason = $stash->{'grant_reason'};
		142	is( $reason, undef, "no grant_reason is stashed when no permissions" );
		143
		144	$tx = $t->ua->build_tx( GET => "/api/v1/patrons/" . $patron->borrowernumber );
		145	$tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
		146	$tx->req->env( { REMOTE_ADDR => $remote_address } );
		147
		148	$t->app->hook(after_dispatch => sub { $stash = shift->stash });
		149	$t->request_ok($tx)->status_is(200);
		150
		151	$reason = $stash->{'grant_reason'};
		152	is( $reason, 'owner', "grant_reason is 'owner'" );
		153
		154	my $guarantee = $builder->build_object({ class => 'Koha::Patrons', value => { guarantorid => $patron->borrowernumber } });
		155
		156	$tx = $t->ua->build_tx( GET => "/api/v1/patrons/" . $guarantee->borrowernumber );
		157	$tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
		158	$tx->req->env( { REMOTE_ADDR => $remote_address } );
		159
		160	$t->app->hook(after_dispatch => sub { $stash = shift->stash });
		161	$t->request_ok($tx)->status_is(200);
		162
		163	$reason = $stash->{'grant_reason'};
		164	is( $reason, 'guarantor', "grant_reason is 'guarantor'" );
		165
		166	$patron->flags(2**4)->store; #
		167
		168	$tx = $t->ua->build_tx( GET => "/api/v1/patrons/" . $guarantee->borrowernumber );
107	$tx->req->cookies( { name => 'CGISESSID', value => $session_id } );	169	$tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
108	$tx->req->env( { REMOTE_ADDR => $remote_address } );	170	$tx->req->env( { REMOTE_ADDR => $remote_address } );
109		171
110	my $stash;
111	$t->app->hook(after_dispatch => sub { $stash = shift->stash });	172	$t->app->hook(after_dispatch => sub { $stash = shift->stash });
112	$t->request_ok($tx)->status_is(200);	173	$t->request_ok($tx)->status_is(200);
113		174
114	my $user = $stash->{'koha.user'};	175	$reason = $stash->{'grant_reason'};
115	ok( defined $user, 'The \'koha.user\' object is defined in the stash') and	176	is( $reason, 'permissions', "grant_reason is 'permissions'" );
116	is( ref($user), 'Koha::Patron', 'Stashed koha.user object type is Koha::Patron') and
117	is( $user->borrowernumber, $borrowernumber, 'The stashed user is the right one' );
118		177
119	$schema->storage->txn_rollback;	178	$schema->storage->txn_rollback;
120	};	179	};
Lines 124-133 sub create_user_and_session { Link Here
124	my $args = shift;	183	my $args = shift;
125	my $flags = ( $args->{authorized} ) ? 16 : 0;	184	my $flags = ( $args->{authorized} ) ? 16 : 0;
126		185
127	my $user = $builder->build(	186	my $patron = $builder->build_object(
128	{	187	{
129	source => 'Borrower',	188	class => 'Koha::Patrons',
130	value => {	189	value => {
131	flags => $flags	190	flags => $flags
132	}	191	}
133	}	192	}
Lines 135-145 sub create_user_and_session { Link Here
135		194
136	# Create a session for the authorized user	195	# Create a session for the authorized user
137	my $session = C4::Auth::get_session('');	196	my $session = C4::Auth::get_session('');
138	$session->param( 'number', $user->{borrowernumber} );	197	$session->param( 'number', $patron->borrowernumber );
139	$session->param( 'id', $user->{userid} );	198	$session->param( 'id', $patron->userid );
140	$session->param( 'ip', '127.0.0.1' );	199	$session->param( 'ip', '127.0.0.1' );
141	$session->param( 'lasttime', time() );	200	$session->param( 'lasttime', time() );
142	$session->flush;	201	$session->flush;
143		202
144	return ( $user->{borrowernumber}, $session->id );	203	return ( $patron, $session->id );
145	}	204	}
146	-