Bugzilla – Attachment 159794 Details for
Bug 35468
Bookings permission mismatch
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 35468: Unit tests
Bug-35468-Unit-tests.patch (text/plain), 14.68 KB, created by
Tomás Cohen Arazi (tcohen)
on 2023-12-13 12:44:54 UTC
(
hide
)
Description:
Bug 35468: Unit tests
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2023-12-13 12:44:54 UTC
Size:
14.68 KB
patch
obsolete
>From 50f9efbbec416857209de33566796b0edf51aedd Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Tue, 12 Dec 2023 14:53:09 +0000 >Subject: [PATCH] Bug 35468: Unit tests > >This patch adds all the 'basic' unit tests one would expect to find with >the api endpoints. I've been working on this as a follow-up to bug >29002 as promised, but hadn't yet submitted them as I wanted to get the >full coverage.. but having these basics in early makes sense whilst I >continue on the more advanced cases. > >Signed-off-by: Nick Clemens <nick@bywatersolutions.com> >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > api/v1/swagger/definitions/booking.yaml | 1 + > t/db_dependent/api/v1/bookings.t | 401 ++++++++++++++++++++++++ > 2 files changed, 402 insertions(+) > create mode 100644 t/db_dependent/api/v1/bookings.t > >diff --git a/api/v1/swagger/definitions/booking.yaml b/api/v1/swagger/definitions/booking.yaml >index 23393a60ff3..a615bb9ed83 100644 >--- a/api/v1/swagger/definitions/booking.yaml >+++ b/api/v1/swagger/definitions/booking.yaml >@@ -10,6 +10,7 @@ properties: > booking_id: > description: Internal booking identifier > type: integer >+ readOnly: true > end_date: > description: Start date and time of this booking > format: date-time >diff --git a/t/db_dependent/api/v1/bookings.t b/t/db_dependent/api/v1/bookings.t >new file mode 100644 >index 00000000000..f581a25de7e >--- /dev/null >+++ b/t/db_dependent/api/v1/bookings.t >@@ -0,0 +1,401 @@ >+#!/usr/bin/env perl >+ >+# This file is part of Koha. >+# >+# Koha is free software; you can redistribute it and/or modify it >+# under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# Koha is distributed in the hope that it will be useful, but >+# WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with Koha; if not, see <http://www.gnu.org/licenses>. >+ >+use Modern::Perl; >+ >+use Test::More tests => 5; >+use Test::Mojo; >+ >+use t::lib::TestBuilder; >+use t::lib::Mocks; >+ >+use JSON qw(encode_json); >+ >+use Koha::Bookings; >+use Koha::Database; >+ >+my $schema = Koha::Database->new->schema; >+my $builder = t::lib::TestBuilder->new; >+ >+my $t = Test::Mojo->new('Koha::REST::V1'); >+t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 ); >+ >+subtest 'list() tests' => sub { >+ >+ plan tests => 20; >+ >+ $schema->storage->txn_begin; >+ >+ Koha::Bookings->search->delete; >+ >+ my $librarian = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { flags => 2**2 } # catalogue flag = 2 >+ } >+ ); >+ my $password = 'thePassword123'; >+ $librarian->set_password( { password => $password, skip_validation => 1 } ); >+ my $userid = $librarian->userid; >+ >+ my $patron = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { flags => 0 } >+ } >+ ); >+ >+ $patron->set_password( { password => $password, skip_validation => 1 } ); >+ my $unauth_userid = $patron->userid; >+ >+ # Unauthorized access >+ $t->get_ok("//$unauth_userid:$password@/api/v1/bookings")->status_is(403); >+ >+ ## Authorized user tests >+ # No bookings, so empty array should be returned >+ $t->get_ok("//$userid:$password@/api/v1/bookings")->status_is(200)->json_is( [] ); >+ >+ # One booking >+ my $start_0 = DateTime->now->subtract( days => 2 )->truncate( to => 'day' ); >+ my $end_0 = DateTime->now->add( days => 4 )->truncate( to => 'day' ); >+ my $booking_0 = $builder->build_object( >+ { >+ class => 'Koha::Bookings', >+ value => { >+ start_date => $start_0, >+ end_date => $end_0 >+ } >+ } >+ ); >+ >+ $t->get_ok("//$userid:$password@/api/v1/bookings")->status_is(200)->json_is( [ $booking_0->to_api ] ); >+ >+ # More bookings >+ my $start_1 = DateTime->now->add( days => 1 )->truncate( to => 'day' ); >+ my $end_1 = DateTime->now->add( days => 6 )->truncate( to => 'day' ); >+ my $booking_1 = $builder->build_object( >+ { >+ class => 'Koha::Bookings', >+ value => { >+ start_date => $start_1, >+ end_date => $end_1 >+ } >+ } >+ ); >+ >+ my $start_2 = DateTime->now->add( days => 4 )->truncate( to => 'day' ); >+ my $end_2 = DateTime->now->add( days => 8 )->truncate( to => 'day' ); >+ my $booking_2 = $builder->build_object( >+ { >+ class => 'Koha::Bookings', >+ value => { >+ start_date => $start_2, >+ end_date => $end_2 >+ } >+ } >+ ); >+ >+ # No filtering >+ $t->get_ok("//$userid:$password@/api/v1/bookings")->status_is(200)->json_is( >+ '' => [ >+ $booking_0->to_api, >+ $booking_1->to_api, >+ $booking_2->to_api >+ ], >+ 'unfiltered returns all bookings' >+ ); >+ >+ # Filtering works, two bookings after today >+ my $api_filter = encode_json( { 'me.start_date' => { '>=' => DateTime->now->rfc3339 } } ); >+ $t->get_ok("//$userid:$password@/api/v1/bookings?q=$api_filter")->status_is(200)->json_is( >+ '' => [ >+ $booking_1->to_api, >+ $booking_2->to_api >+ ], >+ 'filtered returns two future bookings' >+ ); >+ >+ $api_filter = encode_json( { 'me.start_date' => { '<=' => DateTime->now->rfc3339 } } ); >+ $t->get_ok("//$userid:$password@/api/v1/bookings?q=$api_filter")->status_is(200) >+ ->json_is( '' => [ $booking_0->to_api ], 'filtering to before today also works' ); >+ >+ # Warn on unsupported query parameter >+ $t->get_ok("//$userid:$password@/api/v1/bookings?booking_blah=blah")->status_is(400) >+ ->json_is( [ { path => '/query/booking_blah', message => 'Malformed query string' } ] ); >+ >+ $schema->storage->txn_rollback; >+}; >+ >+subtest 'get() tests' => sub { >+ >+ plan tests => 8; >+ >+ $schema->storage->txn_begin; >+ >+ my $booking = $builder->build_object( { class => 'Koha::Bookings' } ); >+ my $librarian = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { flags => 2**2 } # catalogue flag = 2 >+ } >+ ); >+ my $password = 'thePassword123'; >+ $librarian->set_password( { password => $password, skip_validation => 1 } ); >+ my $userid = $librarian->userid; >+ >+ my $patron = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { flags => 0 } >+ } >+ ); >+ >+ $patron->set_password( { password => $password, skip_validation => 1 } ); >+ my $unauth_userid = $patron->userid; >+ >+ # Unauthorized access >+ $t->get_ok( "//$unauth_userid:$password@/api/v1/bookings/" . $booking->booking_id )->status_is(403); >+ >+ # Authorized user tests >+ $t->get_ok( "//$userid:$password@/api/v1/bookings/" . $booking->booking_id )->status_is(200) >+ ->json_is( $booking->to_api ); >+ >+ my $booking_to_delete = $builder->build_object( { class => 'Koha::Bookings' } ); >+ my $non_existent_id = $booking_to_delete->id; >+ $booking_to_delete->delete; >+ >+ $t->get_ok("//$userid:$password@/api/v1/bookings/$non_existent_id")->status_is(404) >+ ->json_is( '/error' => 'Booking not found' ); >+ >+ $schema->storage->txn_rollback; >+}; >+ >+subtest 'add() tests' => sub { >+ >+ plan tests => 15; >+ >+ $schema->storage->txn_begin; >+ >+ my $librarian = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { flags => 2**1 } # circulate flag = 1 >+ } >+ ); >+ my $password = 'thePassword123'; >+ $librarian->set_password( { password => $password, skip_validation => 1 } ); >+ my $userid = $librarian->userid; >+ >+ my $patron = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { flags => 0 } >+ } >+ ); >+ >+ $patron->set_password( { password => $password, skip_validation => 1 } ); >+ my $unauth_userid = $patron->userid; >+ >+ my $biblio = $builder->build_sample_biblio; >+ my $item = $builder->build_sample_item( { bookable => 1, biblionumber => $biblio->id } ); >+ my $booking = { >+ biblio_id => $biblio->id, >+ item_id => undef, >+ patron_id => $patron->id, >+ start_date => DateTime->now->add( days => 2 )->rfc3339, >+ end_date => DateTime->now->add( days => 6 )->rfc3339, >+ }; >+ >+ # Unauthorized attempt to write >+ $t->post_ok( "//$unauth_userid:$password@/api/v1/bookings" => json => $booking )->status_is(403); >+ >+ # Authorized attempt to write invalid data >+ my $booking_with_invalid_field = { %{$booking}, blah => 'some stuff' }; >+ >+ $t->post_ok( "//$userid:$password@/api/v1/bookings" => json => $booking_with_invalid_field )->status_is(400) >+ ->json_is( >+ "/errors" => [ >+ { >+ message => "Properties not allowed: blah.", >+ path => "/body" >+ } >+ ] >+ ); >+ >+ # Authorized attempt to write >+ my $booking_id = >+ $t->post_ok( "//$userid:$password@/api/v1/bookings" => json => $booking )->status_is( 201, 'SWAGGER3.2.1' ) >+ ->header_like( Location => qr|^\/api\/v1\/bookings/\d*|, 'SWAGGER3.4.1' ) >+ ->json_is( '/biblio_id' => $biblio->id )->tx->res->json->{booking_id}; >+ >+ # Authorized attempt to create with null id >+ $booking->{booking_id} = undef; >+ $t->post_ok( "//$userid:$password@/api/v1/bookings" => json => $booking )->status_is(400)->json_has('/errors'); >+ >+ # Authorized attempt to create with existing id >+ $booking->{booking_id} = $booking_id; >+ $t->post_ok( "//$userid:$password@/api/v1/bookings" => json => $booking )->status_is(400)->json_is( >+ "/errors" => [ >+ { >+ message => "Read-only.", >+ path => "/body/booking_id" >+ } >+ ] >+ ); >+ >+ # TODO: Test bookings clashes >+ # TODO: Test item auto-assignment >+ >+ $schema->storage->txn_rollback; >+}; >+ >+subtest 'update() tests' => sub { >+ >+ plan tests => 15; >+ >+ $schema->storage->txn_begin; >+ >+ my $librarian = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { flags => 2**1 } # circulate flag = 1 >+ } >+ ); >+ my $password = 'thePassword123'; >+ $librarian->set_password( { password => $password, skip_validation => 1 } ); >+ my $userid = $librarian->userid; >+ >+ my $patron = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { flags => 0 } >+ } >+ ); >+ >+ $patron->set_password( { password => $password, skip_validation => 1 } ); >+ my $unauth_userid = $patron->userid; >+ >+ my $booking_id = $builder->build_object( { class => 'Koha::Bookings' } )->id; >+ >+ # Unauthorized attempt to update >+ $t->put_ok( >+ "//$unauth_userid:$password@/api/v1/bookings/$booking_id" => json => { name => 'New unauthorized name change' } >+ )->status_is(403); >+ >+ my $biblio = $builder->build_sample_biblio; >+ my $item = $builder->build_sample_item( { bookable => 1, biblionumber => $biblio->id } ); >+ >+ # Attempt partial update on a PUT >+ my $booking_with_missing_field = { >+ item_id => undef, >+ patron_id => $patron->id, >+ start_date => DateTime->now->add( days => 2 )->rfc3339, >+ end_date => DateTime->now->add( days => 6 )->rfc3339, >+ }; >+ >+ $t->put_ok( "//$userid:$password@/api/v1/bookings/$booking_id" => json => $booking_with_missing_field ) >+ ->status_is(400)->json_is( "/errors" => [ { message => "Missing property.", path => "/body/biblio_id" } ] ); >+ >+ # Full object update on PUT >+ my $booking_with_updated_field = { >+ biblio_id => $biblio->id, >+ item_id => undef, >+ patron_id => $patron->id, >+ start_date => DateTime->now->add( days => 2 )->rfc3339, >+ end_date => DateTime->now->add( days => 6 )->rfc3339, >+ }; >+ >+ $t->put_ok( "//$userid:$password@/api/v1/bookings/$booking_id" => json => $booking_with_updated_field ) >+ ->status_is(200)->json_is( '/biblio_id' => $biblio->id ); >+ >+ # Authorized attempt to write invalid data >+ my $booking_with_invalid_field = { >+ blah => "Booking Blah", >+ biblio_id => $biblio->id, >+ item_id => undef, >+ patron_id => $patron->id, >+ start_date => DateTime->now->add( days => 2 )->rfc3339, >+ end_date => DateTime->now->add( days => 6 )->rfc3339, >+ }; >+ >+ $t->put_ok( "//$userid:$password@/api/v1/bookings/$booking_id" => json => $booking_with_invalid_field ) >+ ->status_is(400)->json_is( >+ "/errors" => [ >+ { >+ message => "Properties not allowed: blah.", >+ path => "/body" >+ } >+ ] >+ ); >+ >+ my $booking_to_delete = $builder->build_object( { class => 'Koha::Bookings' } ); >+ my $non_existent_id = $booking_to_delete->id; >+ $booking_to_delete->delete; >+ >+ $t->put_ok( "//$userid:$password@/api/v1/bookings/$non_existent_id" => json => $booking_with_updated_field ) >+ ->status_is(404); >+ >+ # TODO: Test bookings clashes >+ # TODO: Test item auto-assignment >+ >+ # Wrong method (POST) >+ $booking_with_updated_field->{booking_id} = 2; >+ >+ $t->post_ok( "//$userid:$password@/api/v1/bookings/$booking_id" => json => $booking_with_updated_field ) >+ ->status_is(404); >+ >+ $schema->storage->txn_rollback; >+}; >+ >+subtest 'delete() tests' => sub { >+ >+ plan tests => 7; >+ >+ $schema->storage->txn_begin; >+ >+ my $librarian = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { flags => 2**1 } # circulate flag = 1 >+ } >+ ); >+ my $password = 'thePassword123'; >+ $librarian->set_password( { password => $password, skip_validation => 1 } ); >+ my $userid = $librarian->userid; >+ >+ my $patron = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { flags => 0 } >+ } >+ ); >+ >+ $patron->set_password( { password => $password, skip_validation => 1 } ); >+ my $unauth_userid = $patron->userid; >+ >+ my $booking_id = $builder->build_object( { class => 'Koha::Bookings' } )->id; >+ >+ # Unauthorized attempt to delete >+ $t->delete_ok("//$unauth_userid:$password@/api/v1/bookings/$booking_id")->status_is(403); >+ >+ $t->delete_ok("//$userid:$password@/api/v1/bookings/$booking_id")->status_is( 204, 'SWAGGER3.2.4' ) >+ ->content_is( '', 'SWAGGER3.3.4' ); >+ >+ $t->delete_ok("//$userid:$password@/api/v1/bookings/$booking_id")->status_is(404); >+ >+ $schema->storage->txn_rollback; >+}; >-- >2.43.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 35468
:
159734
|
159746
|
159754
|
159755
|
159756
|
159757
|
159789
|
159790
|
159791
|
159792
|
159793
| 159794 |
159795
|
159796
|
159881