Attachment #85857 for bug #20006

View | Details | Raw Unified | Return to bug 20006
Collapse All | Expand All





use Modern::Perl;

use Test::More tests => 4;
use Test::Mojo;
use t::lib::TestBuilder;
use t::lib::Mocks;

my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $patron_2->borrowernumber,
    $biblionumber, undef, 2, undef, undef, undef, '', $itemnumber);

my $suspended_until = DateTime->now->add(days => 10)->truncate( to => 'day' );
my $expiration_date = DateTime->now->add(days => 10)->truncate( to => 'day' );

my $post_data = {
    patron_id => int($patron_1->borrowernumber),
    biblio_id => int($biblionumber),
    item_id => int($itemnumber),
    pickup_library_id => $branchcode,
    expiration_date => output_pref({ dt => $expiration_date, dateformat => 'rfc3339', dateonly => 1 }),
    priority => 2,
};
my $put_data = {
    priority => 2,
    suspended_until => output_pref({ dt => $suspended_until, dateformat => 'rfc3339' }),
};

subtest "Test endpoints without authentication" => sub {

subtest "Test endpoints without permission" => sub {
    plan tests => 10;

    $tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
    $t->request_ok($tx) # no permission
      ->status_is(403);
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
    $t->request_ok($tx) # reserveforothers permission
      ->status_is(403);

    $t->request_ok($tx) # no permission
      ->status_is(403);
};
subtest "Test endpoints without permission, but accessing own object" => sub {
    plan tests => 16;

    my $borrno_tmp = $post_data->{'borrowernumber'};
    $post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'};
    $tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data);
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
    $t->request_ok($tx) # create hold to myself
      ->status_is(201)
      ->json_has('/reserve_id');

    $post_data->{'borrowernumber'} = $borrno_tmp;
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=".$nopermission-> { borrowernumber });
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
    $t->request_ok($tx) # get my own holds
      ->status_is(200)
      ->json_is('/0/borrowernumber', $nopermission->{ borrowernumber })
      ->json_is('/0/biblionumber', $biblionumber)
      ->json_is('/0/itemnumber', $itemnumber)
      ->json_is('/0/expirationdate', $expirationdate)
      ->json_is('/0/branchcode', $branchcode);

    my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id;
    $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data);
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
    $t->request_ok($tx)    # create hold to myself
      ->status_is(200)->json_is( '/reserve_id', $reserve_id3 )->json_is(
        '/suspend_until',
        output_pref(
            {
                dateformat => 'rfc3339',
                dt => dt_from_string( $suspend_until . ' 00:00:00', 'sql' )
            }
        )
      )
      ->json_is( '/priority',   2 )
      ->json_is( '/itemnumber', $itemnumber );
};

subtest "Test endpoints with permission" => sub {

    plan tests => 44;

    $tx = $t->ua->build_tx(GET => '/api/v1/holds');
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});

      ->status_is(200)
      ->json_has('/0')
      ->json_has('/1')
      ->json_hasnt('/2');
      ->json_hasnt('/3');

    $tx = $t->ua->build_tx(GET => '/api/v1/holds?priority=2');
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
    $t->request_ok($tx)
      ->status_is(200)
      ->json_is('/0/patron_id', $patron_2->borrowernumber)
      ->json_hasnt('/1');

    $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id" => json => $put_data);
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
    $t->request_ok($tx)
      ->status_is(200)
      ->json_is( '/hold_id', $reserve_id )
      ->json_is( '/suspended_until', output_pref({ dt => $suspended_until, dateformat => 'rfc3339' }) )
            {
                dateformat => 'rfc3339',
                dt => dt_from_string( $suspend_until . ' 00:00:00', 'sql' )
            }
        )
      )
      ->json_is( '/priority', 2 );

    $tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id");

      ->status_is(404)
      ->json_has('/error');

    $tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
    $tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag
    $t->request_ok($tx)
      ->status_is(200)
      ->json_is([]);

    my $inexisting_borrowernumber = $patron_2->borrowernumber * 2;
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=$inexisting_borrowernumber");
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
    $t->request_ok($tx)
      ->status_is(200)

    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
    $t->request_ok($tx)
      ->status_is(201)
      ->json_has('/hold_id');
    $reserve_id = $t->tx->res->json->{hold_id};

    $tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
    $t->request_ok($tx)
      ->status_is(200)
      ->json_is('/0/hold_id', $reserve_id)
      ->json_is('/0/expiration_date', output_pref({ dt => $expiration_date, dateformat => 'rfc3339', dateonly => 1 }))
      ->json_is('/0/pickup_library_id', $branchcode);

    $tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data);
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});

    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
    $t->request_ok($tx)
      ->status_is(403)
      ->json_like('/error', qr/itemAlreadyOnHold/);
};


subtest 'Reserves with itemtype' => sub {
    plan tests => 9;

    my $post_data = {
        patron_id => int($patron_1->borrowernumber),
        biblio_id => int($biblionumber),
        pickup_library_id => $branchcode,
        item_type => $itemtype,
    };

    $tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id");

    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
    $t->request_ok($tx)
      ->status_is(201)
      ->json_has('/hold_id');

    $reserve_id = $t->tx->res->json->{hold_id};

    $tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
    $t->request_ok($tx)
      ->status_is(200)
      ->json_is('/0/hold_id', $reserve_id)
      ->json_is('/0/item_type', $itemtype);
};

$schema->storage->txn_rollback;
- 

Return to bug 20006

Lines 17-23 Link Here

(-)a/t/db_dependent/api/v1/holds.t (-83 / +38 lines)
17		17
18	use Modern::Perl;	18	use Modern::Perl;
19		19
20	use Test::More tests => 5;	20	use Test::More tests => 4;
21	use Test::Mojo;	21	use Test::Mojo;
22	use t::lib::TestBuilder;	22	use t::lib::TestBuilder;
23	use t::lib::Mocks;	23	use t::lib::Mocks;
Lines 149-167 my $reserve_id = C4::Reserves::AddReserve($branchcode, $patron_1->borrowernumber Link Here
149	my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $patron_2->borrowernumber,	149	my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $patron_2->borrowernumber,
150	$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber);	150	$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber);
151		151
152	my $suspend_until = DateTime->now->add(days => 10)->ymd;	152	my $suspended_until = DateTime->now->add(days => 10)->truncate( to => 'day' );
153	my $expirationdate = DateTime->now->add(days => 10)->ymd;	153	my $expiration_date = DateTime->now->add(days => 10)->truncate( to => 'day' );
154		154
155	my $post_data = {	155	my $post_data = {
156	borrowernumber => int($patron_1->borrowernumber),	156	patron_id => int($patron_1->borrowernumber),
157	biblionumber => int($biblionumber),	157	biblio_id => int($biblionumber),
158	itemnumber => int($itemnumber),	158	item_id => int($itemnumber),
159	branchcode => $branchcode,	159	pickup_library_id => $branchcode,
160	expirationdate => $expirationdate,	160	expiration_date => output_pref({ dt => $expiration_date, dateformat => 'rfc3339', dateonly => 1 }),
		161	priority => 2,
161	};	162	};
162	my $put_data = {	163	my $put_data = {
163	priority => 2,	164	priority => 2,
164	suspend_until => $suspend_until,	165	suspended_until => output_pref({ dt => $suspended_until, dateformat => 'rfc3339' }),
165	};	166	};
166		167
167	subtest "Test endpoints without authentication" => sub {	168	subtest "Test endpoints without authentication" => sub {
Lines 180-190 subtest "Test endpoints without authentication" => sub { Link Here
180	subtest "Test endpoints without permission" => sub {	181	subtest "Test endpoints without permission" => sub {
181	plan tests => 10;	182	plan tests => 10;
182		183
183	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);	184	$tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
184	$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});	185	$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
185	$t->request_ok($tx) # no permission	186	$t->request_ok($tx) # no permission
186	->status_is(403);	187	->status_is(403);
187	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);	188	$tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
188	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});	189	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});
189	$t->request_ok($tx) # reserveforothers permission	190	$t->request_ok($tx) # reserveforothers permission
190	->status_is(403);	191	->status_is(403);
Lines 201-247 subtest "Test endpoints without permission" => sub { Link Here
201	$t->request_ok($tx) # no permission	202	$t->request_ok($tx) # no permission
202	->status_is(403);	203	->status_is(403);
203	};	204	};
204	subtest "Test endpoints without permission, but accessing own object" => sub {
205	plan tests => 16;
206
207	my $borrno_tmp = $post_data->{'borrowernumber'};
208	$post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'};
209	$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data);
210	$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
211	$t->request_ok($tx) # create hold to myself
212	->status_is(201)
213	->json_has('/reserve_id');
214
215	$post_data->{'borrowernumber'} = $borrno_tmp;
216	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=".$nopermission-> { borrowernumber });
217	$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
218	$t->request_ok($tx) # get my own holds
219	->status_is(200)
220	->json_is('/0/borrowernumber', $nopermission->{ borrowernumber })
221	->json_is('/0/biblionumber', $biblionumber)
222	->json_is('/0/itemnumber', $itemnumber)
223	->json_is('/0/expirationdate', $expirationdate)
224	->json_is('/0/branchcode', $branchcode);
225
226	my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id;
227	$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data);
228	$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
229	$t->request_ok($tx) # create hold to myself
230	->status_is(200)->json_is( '/reserve_id', $reserve_id3 )->json_is(
231	'/suspend_until',
232	output_pref(
233	{
234	dateformat => 'rfc3339',
235	dt => dt_from_string( $suspend_until . ' 00:00:00', 'sql' )
236	}
237	)
238	)
239	->json_is( '/priority', 2 )
240	->json_is( '/itemnumber', $itemnumber );
241	};
242		205
243	subtest "Test endpoints with permission" => sub {	206	subtest "Test endpoints with permission" => sub {
244	plan tests => 45;	207
		208	plan tests => 44;
245		209
246	$tx = $t->ua->build_tx(GET => '/api/v1/holds');	210	$tx = $t->ua->build_tx(GET => '/api/v1/holds');
247	$tx->req->cookies({name => 'CGISESSID', value => $session->id});	211	$tx->req->cookies({name => 'CGISESSID', value => $session->id});
Lines 249-276 subtest "Test endpoints with permission" => sub { Link Here
249	->status_is(200)	213	->status_is(200)
250	->json_has('/0')	214	->json_has('/0')
251	->json_has('/1')	215	->json_has('/1')
252	->json_has('/2')	216	->json_hasnt('/2');
253	->json_hasnt('/3');
254		217
255	$tx = $t->ua->build_tx(GET => '/api/v1/holds?priority=2');	218	$tx = $t->ua->build_tx(GET => '/api/v1/holds?priority=2');
256	$tx->req->cookies({name => 'CGISESSID', value => $session->id});	219	$tx->req->cookies({name => 'CGISESSID', value => $session->id});
257	$t->request_ok($tx)	220	$t->request_ok($tx)
258	->status_is(200)	221	->status_is(200)
259	->json_is('/0/borrowernumber', $nopermission->{borrowernumber})	222	->json_is('/0/patron_id', $patron_2->borrowernumber)
260	->json_hasnt('/1');	223	->json_hasnt('/1');
261		224
262	$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id" => json => $put_data);	225	$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id" => json => $put_data);
263	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});	226	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});
264	$t->request_ok($tx)->status_is(200)->json_is( '/reserve_id', $reserve_id )	227	$t->request_ok($tx)
265	->json_is(	228	->status_is(200)
266	'/suspend_until',	229	->json_is( '/hold_id', $reserve_id )
267	output_pref(	230	->json_is( '/suspended_until', output_pref({ dt => $suspended_until, dateformat => 'rfc3339' }) )
268	{
269	dateformat => 'rfc3339',
270	dt => dt_from_string( $suspend_until . ' 00:00:00', 'sql' )
271	}
272	)
273	)
274	->json_is( '/priority', 2 );	231	->json_is( '/priority', 2 );
275		232
276	$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id");	233	$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id");
Lines 290-303 subtest "Test endpoints with permission" => sub { Link Here
290	->status_is(404)	247	->status_is(404)
291	->json_has('/error');	248	->json_has('/error');
292		249
293	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);	250	$tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
294	$tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag	251	$tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag
295	$t->request_ok($tx)	252	$t->request_ok($tx)
296	->status_is(200)	253	->status_is(200)
297	->json_is([]);	254	->json_is([]);
298		255
299	my $inexisting_borrowernumber = $patron_2->borrowernumber * 2;	256	my $inexisting_borrowernumber = $patron_2->borrowernumber * 2;
300	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$inexisting_borrowernumber");	257	$tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=$inexisting_borrowernumber");
301	$tx->req->cookies({name => 'CGISESSID', value => $session->id});	258	$tx->req->cookies({name => 'CGISESSID', value => $session->id});
302	$t->request_ok($tx)	259	$t->request_ok($tx)
303	->status_is(200)	260	->status_is(200)
Lines 312-327 subtest "Test endpoints with permission" => sub { Link Here
312	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});	269	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});
313	$t->request_ok($tx)	270	$t->request_ok($tx)
314	->status_is(201)	271	->status_is(201)
315	->json_has('/reserve_id');	272	->json_has('/hold_id');
316	$reserve_id = $t->tx->res->json->{reserve_id};	273	$reserve_id = $t->tx->res->json->{hold_id};
317		274
318	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);	275	$tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
319	$tx->req->cookies({name => 'CGISESSID', value => $session->id});	276	$tx->req->cookies({name => 'CGISESSID', value => $session->id});
320	$t->request_ok($tx)	277	$t->request_ok($tx)
321	->status_is(200)	278	->status_is(200)
322	->json_is('/0/reserve_id', $reserve_id)	279	->json_is('/0/hold_id', $reserve_id)
323	->json_is('/0/expirationdate', $expirationdate)	280	->json_is('/0/expiration_date', output_pref({ dt => $expiration_date, dateformat => 'rfc3339', dateonly => 1 }))
324	->json_is('/0/branchcode', $branchcode);	281	->json_is('/0/pickup_library_id', $branchcode);
325		282
326	$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data);	283	$tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data);
327	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});	284	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});
Lines 335-352 subtest "Test endpoints with permission" => sub { Link Here
335	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});	292	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});
336	$t->request_ok($tx)	293	$t->request_ok($tx)
337	->status_is(403)	294	->status_is(403)
338	->json_like('/error', qr/tooManyReserves/);	295	->json_like('/error', qr/itemAlreadyOnHold/);
339	};	296	};
340		297
341
342	subtest 'Reserves with itemtype' => sub {	298	subtest 'Reserves with itemtype' => sub {
343	plan tests => 9;	299	plan tests => 9;
344		300
345	my $post_data = {	301	my $post_data = {
346	borrowernumber => int($patron_1->borrowernumber),	302	patron_id => int($patron_1->borrowernumber),
347	biblionumber => int($biblionumber),	303	biblio_id => int($biblionumber),
348	branchcode => $branchcode,	304	pickup_library_id => $branchcode,
349	itemtype => $itemtype,	305	item_type => $itemtype,
350	};	306	};
351		307
352	$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id");	308	$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id");
Lines 358-373 subtest 'Reserves with itemtype' => sub { Link Here
358	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});	314	$tx->req->cookies({name => 'CGISESSID', value => $session3->id});
359	$t->request_ok($tx)	315	$t->request_ok($tx)
360	->status_is(201)	316	->status_is(201)
361	->json_has('/reserve_id');	317	->json_has('/hold_id');
362		318
363	$reserve_id = $t->tx->res->json->{reserve_id};	319	$reserve_id = $t->tx->res->json->{hold_id};
364		320
365	$tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);	321	$tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
366	$tx->req->cookies({name => 'CGISESSID', value => $session->id});	322	$tx->req->cookies({name => 'CGISESSID', value => $session->id});
367	$t->request_ok($tx)	323	$t->request_ok($tx)
368	->status_is(200)	324	->status_is(200)
369	->json_is('/0/reserve_id', $reserve_id)	325	->json_is('/0/hold_id', $reserve_id)
370	->json_is('/0/itemtype', $itemtype);	326	->json_is('/0/item_type', $itemtype);
371	};	327	};
372		328
373	$schema->storage->txn_rollback;	329	$schema->storage->txn_rollback;
374	-