|
Lines 17-23
Link Here
|
| 17 |
|
17 |
|
| 18 |
use Modern::Perl; |
18 |
use Modern::Perl; |
| 19 |
|
19 |
|
| 20 |
use Test::More tests => 5; |
20 |
use Test::More tests => 4; |
| 21 |
use Test::Mojo; |
21 |
use Test::Mojo; |
| 22 |
use t::lib::TestBuilder; |
22 |
use t::lib::TestBuilder; |
| 23 |
use t::lib::Mocks; |
23 |
use t::lib::Mocks; |
|
Lines 149-167
my $reserve_id = C4::Reserves::AddReserve($branchcode, $patron_1->borrowernumber
Link Here
|
| 149 |
my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $patron_2->borrowernumber, |
149 |
my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $patron_2->borrowernumber, |
| 150 |
$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber); |
150 |
$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber); |
| 151 |
|
151 |
|
| 152 |
my $suspend_until = DateTime->now->add(days => 10)->ymd; |
152 |
my $suspended_until = DateTime->now->add(days => 10)->truncate( to => 'day' ); |
| 153 |
my $expirationdate = DateTime->now->add(days => 10)->ymd; |
153 |
my $expiration_date = DateTime->now->add(days => 10)->truncate( to => 'day' ); |
| 154 |
|
154 |
|
| 155 |
my $post_data = { |
155 |
my $post_data = { |
| 156 |
borrowernumber => int($patron_1->borrowernumber), |
156 |
patron_id => int($patron_1->borrowernumber), |
| 157 |
biblionumber => int($biblionumber), |
157 |
biblio_id => int($biblionumber), |
| 158 |
itemnumber => int($itemnumber), |
158 |
item_id => int($itemnumber), |
| 159 |
branchcode => $branchcode, |
159 |
pickup_library_id => $branchcode, |
| 160 |
expirationdate => $expirationdate, |
160 |
expiration_date => output_pref({ dt => $expiration_date, dateformat => 'rfc3339', dateonly => 1 }), |
|
|
161 |
priority => 2, |
| 161 |
}; |
162 |
}; |
| 162 |
my $put_data = { |
163 |
my $put_data = { |
| 163 |
priority => 2, |
164 |
priority => 2, |
| 164 |
suspend_until => $suspend_until, |
165 |
suspended_until => output_pref({ dt => $suspended_until, dateformat => 'rfc3339' }), |
| 165 |
}; |
166 |
}; |
| 166 |
|
167 |
|
| 167 |
subtest "Test endpoints without authentication" => sub { |
168 |
subtest "Test endpoints without authentication" => sub { |
|
Lines 180-190
subtest "Test endpoints without authentication" => sub {
Link Here
|
| 180 |
subtest "Test endpoints without permission" => sub { |
181 |
subtest "Test endpoints without permission" => sub { |
| 181 |
plan tests => 10; |
182 |
plan tests => 10; |
| 182 |
|
183 |
|
| 183 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber); |
184 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber); |
| 184 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
185 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 185 |
$t->request_ok($tx) # no permission |
186 |
$t->request_ok($tx) # no permission |
| 186 |
->status_is(403); |
187 |
->status_is(403); |
| 187 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber); |
188 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber); |
| 188 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
189 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 189 |
$t->request_ok($tx) # reserveforothers permission |
190 |
$t->request_ok($tx) # reserveforothers permission |
| 190 |
->status_is(403); |
191 |
->status_is(403); |
|
Lines 201-247
subtest "Test endpoints without permission" => sub {
Link Here
|
| 201 |
$t->request_ok($tx) # no permission |
202 |
$t->request_ok($tx) # no permission |
| 202 |
->status_is(403); |
203 |
->status_is(403); |
| 203 |
}; |
204 |
}; |
| 204 |
subtest "Test endpoints without permission, but accessing own object" => sub { |
|
|
| 205 |
plan tests => 16; |
| 206 |
|
| 207 |
my $borrno_tmp = $post_data->{'borrowernumber'}; |
| 208 |
$post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'}; |
| 209 |
$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data); |
| 210 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 211 |
$t->request_ok($tx) # create hold to myself |
| 212 |
->status_is(201) |
| 213 |
->json_has('/reserve_id'); |
| 214 |
|
| 215 |
$post_data->{'borrowernumber'} = $borrno_tmp; |
| 216 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=".$nopermission-> { borrowernumber }); |
| 217 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 218 |
$t->request_ok($tx) # get my own holds |
| 219 |
->status_is(200) |
| 220 |
->json_is('/0/borrowernumber', $nopermission->{ borrowernumber }) |
| 221 |
->json_is('/0/biblionumber', $biblionumber) |
| 222 |
->json_is('/0/itemnumber', $itemnumber) |
| 223 |
->json_is('/0/expirationdate', $expirationdate) |
| 224 |
->json_is('/0/branchcode', $branchcode); |
| 225 |
|
| 226 |
my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id; |
| 227 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data); |
| 228 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
| 229 |
$t->request_ok($tx) # create hold to myself |
| 230 |
->status_is(200)->json_is( '/reserve_id', $reserve_id3 )->json_is( |
| 231 |
'/suspend_until', |
| 232 |
output_pref( |
| 233 |
{ |
| 234 |
dateformat => 'rfc3339', |
| 235 |
dt => dt_from_string( $suspend_until . ' 00:00:00', 'sql' ) |
| 236 |
} |
| 237 |
) |
| 238 |
) |
| 239 |
->json_is( '/priority', 2 ) |
| 240 |
->json_is( '/itemnumber', $itemnumber ); |
| 241 |
}; |
| 242 |
|
205 |
|
| 243 |
subtest "Test endpoints with permission" => sub { |
206 |
subtest "Test endpoints with permission" => sub { |
| 244 |
plan tests => 45; |
207 |
|
|
|
208 |
plan tests => 44; |
| 245 |
|
209 |
|
| 246 |
$tx = $t->ua->build_tx(GET => '/api/v1/holds'); |
210 |
$tx = $t->ua->build_tx(GET => '/api/v1/holds'); |
| 247 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
211 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
|
Lines 249-276
subtest "Test endpoints with permission" => sub {
Link Here
|
| 249 |
->status_is(200) |
213 |
->status_is(200) |
| 250 |
->json_has('/0') |
214 |
->json_has('/0') |
| 251 |
->json_has('/1') |
215 |
->json_has('/1') |
| 252 |
->json_has('/2') |
216 |
->json_hasnt('/2'); |
| 253 |
->json_hasnt('/3'); |
|
|
| 254 |
|
217 |
|
| 255 |
$tx = $t->ua->build_tx(GET => '/api/v1/holds?priority=2'); |
218 |
$tx = $t->ua->build_tx(GET => '/api/v1/holds?priority=2'); |
| 256 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
219 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
| 257 |
$t->request_ok($tx) |
220 |
$t->request_ok($tx) |
| 258 |
->status_is(200) |
221 |
->status_is(200) |
| 259 |
->json_is('/0/borrowernumber', $nopermission->{borrowernumber}) |
222 |
->json_is('/0/patron_id', $patron_2->borrowernumber) |
| 260 |
->json_hasnt('/1'); |
223 |
->json_hasnt('/1'); |
| 261 |
|
224 |
|
| 262 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id" => json => $put_data); |
225 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id" => json => $put_data); |
| 263 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
226 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 264 |
$t->request_ok($tx)->status_is(200)->json_is( '/reserve_id', $reserve_id ) |
227 |
$t->request_ok($tx) |
| 265 |
->json_is( |
228 |
->status_is(200) |
| 266 |
'/suspend_until', |
229 |
->json_is( '/hold_id', $reserve_id ) |
| 267 |
output_pref( |
230 |
->json_is( '/suspended_until', output_pref({ dt => $suspended_until, dateformat => 'rfc3339' }) ) |
| 268 |
{ |
|
|
| 269 |
dateformat => 'rfc3339', |
| 270 |
dt => dt_from_string( $suspend_until . ' 00:00:00', 'sql' ) |
| 271 |
} |
| 272 |
) |
| 273 |
) |
| 274 |
->json_is( '/priority', 2 ); |
231 |
->json_is( '/priority', 2 ); |
| 275 |
|
232 |
|
| 276 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id"); |
233 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id"); |
|
Lines 290-303
subtest "Test endpoints with permission" => sub {
Link Here
|
| 290 |
->status_is(404) |
247 |
->status_is(404) |
| 291 |
->json_has('/error'); |
248 |
->json_has('/error'); |
| 292 |
|
249 |
|
| 293 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber); |
250 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber); |
| 294 |
$tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag |
251 |
$tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag |
| 295 |
$t->request_ok($tx) |
252 |
$t->request_ok($tx) |
| 296 |
->status_is(200) |
253 |
->status_is(200) |
| 297 |
->json_is([]); |
254 |
->json_is([]); |
| 298 |
|
255 |
|
| 299 |
my $inexisting_borrowernumber = $patron_2->borrowernumber * 2; |
256 |
my $inexisting_borrowernumber = $patron_2->borrowernumber * 2; |
| 300 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$inexisting_borrowernumber"); |
257 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=$inexisting_borrowernumber"); |
| 301 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
258 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
| 302 |
$t->request_ok($tx) |
259 |
$t->request_ok($tx) |
| 303 |
->status_is(200) |
260 |
->status_is(200) |
|
Lines 312-327
subtest "Test endpoints with permission" => sub {
Link Here
|
| 312 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
269 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 313 |
$t->request_ok($tx) |
270 |
$t->request_ok($tx) |
| 314 |
->status_is(201) |
271 |
->status_is(201) |
| 315 |
->json_has('/reserve_id'); |
272 |
->json_has('/hold_id'); |
| 316 |
$reserve_id = $t->tx->res->json->{reserve_id}; |
273 |
$reserve_id = $t->tx->res->json->{hold_id}; |
| 317 |
|
274 |
|
| 318 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber); |
275 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber); |
| 319 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
276 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
| 320 |
$t->request_ok($tx) |
277 |
$t->request_ok($tx) |
| 321 |
->status_is(200) |
278 |
->status_is(200) |
| 322 |
->json_is('/0/reserve_id', $reserve_id) |
279 |
->json_is('/0/hold_id', $reserve_id) |
| 323 |
->json_is('/0/expirationdate', $expirationdate) |
280 |
->json_is('/0/expiration_date', output_pref({ dt => $expiration_date, dateformat => 'rfc3339', dateonly => 1 })) |
| 324 |
->json_is('/0/branchcode', $branchcode); |
281 |
->json_is('/0/pickup_library_id', $branchcode); |
| 325 |
|
282 |
|
| 326 |
$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data); |
283 |
$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data); |
| 327 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
284 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
|
Lines 335-352
subtest "Test endpoints with permission" => sub {
Link Here
|
| 335 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
292 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 336 |
$t->request_ok($tx) |
293 |
$t->request_ok($tx) |
| 337 |
->status_is(403) |
294 |
->status_is(403) |
| 338 |
->json_like('/error', qr/tooManyReserves/); |
295 |
->json_like('/error', qr/itemAlreadyOnHold/); |
| 339 |
}; |
296 |
}; |
| 340 |
|
297 |
|
| 341 |
|
|
|
| 342 |
subtest 'Reserves with itemtype' => sub { |
298 |
subtest 'Reserves with itemtype' => sub { |
| 343 |
plan tests => 9; |
299 |
plan tests => 9; |
| 344 |
|
300 |
|
| 345 |
my $post_data = { |
301 |
my $post_data = { |
| 346 |
borrowernumber => int($patron_1->borrowernumber), |
302 |
patron_id => int($patron_1->borrowernumber), |
| 347 |
biblionumber => int($biblionumber), |
303 |
biblio_id => int($biblionumber), |
| 348 |
branchcode => $branchcode, |
304 |
pickup_library_id => $branchcode, |
| 349 |
itemtype => $itemtype, |
305 |
item_type => $itemtype, |
| 350 |
}; |
306 |
}; |
| 351 |
|
307 |
|
| 352 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id"); |
308 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id"); |
|
Lines 358-373
subtest 'Reserves with itemtype' => sub {
Link Here
|
| 358 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
314 |
$tx->req->cookies({name => 'CGISESSID', value => $session3->id}); |
| 359 |
$t->request_ok($tx) |
315 |
$t->request_ok($tx) |
| 360 |
->status_is(201) |
316 |
->status_is(201) |
| 361 |
->json_has('/reserve_id'); |
317 |
->json_has('/hold_id'); |
| 362 |
|
318 |
|
| 363 |
$reserve_id = $t->tx->res->json->{reserve_id}; |
319 |
$reserve_id = $t->tx->res->json->{hold_id}; |
| 364 |
|
320 |
|
| 365 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber); |
321 |
$tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber); |
| 366 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
322 |
$tx->req->cookies({name => 'CGISESSID', value => $session->id}); |
| 367 |
$t->request_ok($tx) |
323 |
$t->request_ok($tx) |
| 368 |
->status_is(200) |
324 |
->status_is(200) |
| 369 |
->json_is('/0/reserve_id', $reserve_id) |
325 |
->json_is('/0/hold_id', $reserve_id) |
| 370 |
->json_is('/0/itemtype', $itemtype); |
326 |
->json_is('/0/item_type', $itemtype); |
| 371 |
}; |
327 |
}; |
| 372 |
|
328 |
|
| 373 |
$schema->storage->txn_rollback; |
329 |
$schema->storage->txn_rollback; |
| 374 |
- |
|
|