View | Details | Raw Unified | Return to bug 27587
Collapse All | Expand All

(-)a/t/db_dependent/api/v1/acquisitions_vendors.t (-196 / +122 lines)
Lines 18-42 Link Here
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 5;
20
use Test::More tests => 5;
21
21
use Test::Mojo;
22
use Test::Mojo;
22
use Test::Warn;
23
23
24
use t::lib::TestBuilder;
24
use t::lib::TestBuilder;
25
use t::lib::Mocks;
25
use t::lib::Mocks;
26
26
27
use C4::Auth;
28
use Koha::Acquisition::Booksellers;
27
use Koha::Acquisition::Booksellers;
29
use Koha::Database;
28
use Koha::Database;
30
29
31
my $schema  = Koha::Database->new->schema;
30
my $schema  = Koha::Database->new->schema;
32
my $builder = t::lib::TestBuilder->new;
31
my $builder = t::lib::TestBuilder->new;
33
32
34
# FIXME: sessionStorage defaults to mysql, but it seems to break transaction handling
33
t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
35
# this affects the other REST api tests
36
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
37
34
38
my $remote_address = '127.0.0.1';
35
my $t = Test::Mojo->new('Koha::REST::V1');
39
my $t              = Test::Mojo->new('Koha::REST::V1');
40
36
41
subtest 'list() and delete() tests | authorized user' => sub {
37
subtest 'list() and delete() tests | authorized user' => sub {
42
38
Lines 46-60 subtest 'list() and delete() tests | authorized user' => sub { Link Here
46
42
47
    $schema->resultset('Aqbasket')->search->delete;
43
    $schema->resultset('Aqbasket')->search->delete;
48
    Koha::Acquisition::Booksellers->search->delete;
44
    Koha::Acquisition::Booksellers->search->delete;
49
    my ( $borrowernumber, $session_id )
45
50
        = create_user_and_session( { authorized => 1 } );
46
    my $patron = $builder->build_object({
47
        class => 'Koha::Patrons',
48
        value => { flags => 2 ** 11 } ## 11 => acquisitions
49
    });
50
    my $password = 'thePassword123';
51
    $patron->set_password({ password => $password, skip_validation => 1 });
52
    my $userid = $patron->userid;
51
53
52
    ## Authorized user tests
54
    ## Authorized user tests
53
    # No vendors, so empty array should be returned
55
    # No vendors, so empty array should be returned
54
    my $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors' );
56
    $t->get_ok( "//$userid:$password@/api/v1/acquisitions/vendors" )
55
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
56
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
57
    $t->request_ok($tx)
58
      ->status_is(200)
57
      ->status_is(200)
59
      ->json_is( [] );
58
      ->json_is( [] );
60
59
Lines 62-71 subtest 'list() and delete() tests | authorized user' => sub { Link Here
62
    my $vendor = $builder->build_object({ class => 'Koha::Acquisition::Booksellers', value => { name => $vendor_name } });
61
    my $vendor = $builder->build_object({ class => 'Koha::Acquisition::Booksellers', value => { name => $vendor_name } });
63
62
64
    # One vendor created, should get returned
63
    # One vendor created, should get returned
65
    $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors' );
64
    $t->get_ok( "//$userid:$password@/api/v1/acquisitions/vendors" )
66
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
67
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
68
    $t->request_ok($tx)
69
      ->status_is(200)
65
      ->status_is(200)
70
      ->json_like( '/0/name' => qr/$vendor_name/ );
66
      ->json_like( '/0/name' => qr/$vendor_name/ );
71
67
Lines 73-140 subtest 'list() and delete() tests | authorized user' => sub { Link Here
73
    my $other_vendor
69
    my $other_vendor
74
        = $builder->build_object({ class => 'Koha::Acquisition::Booksellers', value => { name => $other_vendor_name } });
70
        = $builder->build_object({ class => 'Koha::Acquisition::Booksellers', value => { name => $other_vendor_name } });
75
71
76
    $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors' );
72
    $t->get_ok( "//$userid:$password@/api/v1/acquisitions/vendors" )
77
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
78
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
79
    $t->request_ok($tx)
80
      ->status_is(200)
73
      ->status_is(200)
81
      ->json_like( '/0/name' => qr/Ruben/ )
74
      ->json_like( '/0/name' => qr/Ruben/ )
82
      ->json_like( '/1/name' => qr/Amerindia/ );
75
      ->json_like( '/1/name' => qr/Amerindia/ );
83
76
84
    $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors?name=' . $vendor_name );
77
    $t->get_ok( "//$userid:$password@/api/v1/acquisitions/vendors?name=$vendor_name" )
85
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
86
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
87
    $t->request_ok($tx)
88
      ->status_is(200)
78
      ->status_is(200)
89
      ->json_like( '/0/name' => qr/Ruben/ );
79
      ->json_like( '/0/name' => qr/Ruben/ );
90
80
91
    $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors?name=' . $other_vendor_name );
81
    $t->get_ok( "//$userid:$password@/api/v1/acquisitions/vendors?name=$other_vendor_name" )
92
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
93
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
94
    $t->request_ok($tx)
95
      ->status_is(200)
82
      ->status_is(200)
96
      ->json_like( '/0/name' => qr/Amerindia/ );
83
      ->json_like( '/0/name' => qr/Amerindia/ );
97
84
98
    $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors?accountnumber=' . $vendor->accountnumber );
85
99
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
86
    $t->get_ok( "//$userid:$password@/api/v1/acquisitions/vendors?accountnumber=" . $vendor->accountnumber )
100
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
101
    $t->request_ok($tx)
102
      ->status_is(200)
87
      ->status_is(200)
103
      ->json_like( '/0/name' => qr/Ruben/ );
88
      ->json_like( '/0/name' => qr/Ruben/ );
104
89
105
    $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors?accountnumber=' . $other_vendor->accountnumber );
90
    $t->get_ok( "//$userid:$password@/api/v1/acquisitions/vendors?accountnumber=" . $other_vendor->accountnumber )
106
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
107
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
108
    $t->request_ok($tx)
109
      ->status_is(200)
91
      ->status_is(200)
110
      ->json_like( '/0/name' => qr/Amerindia/ );
92
      ->json_like( '/0/name' => qr/Amerindia/ );
111
93
112
    $tx = $t->ua->build_tx( DELETE => '/api/v1/acquisitions/vendors/' . $vendor->id );
94
    $t->delete_ok( "//$userid:$password@/api/v1/acquisitions/vendors/" . $vendor->id )
113
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
114
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
115
    $t->request_ok($tx)
116
      ->status_is(204, 'SWAGGER3.2.4')
95
      ->status_is(204, 'SWAGGER3.2.4')
117
      ->content_is('', 'SWAGGER3.3.4');
96
      ->content_is('', 'SWAGGER3.3.4');
118
97
119
    $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors' );
98
    $t->get_ok( "//$userid:$password@/api/v1/acquisitions/vendors" )
120
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
121
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
122
    $t->request_ok($tx)
123
      ->status_is(200)
99
      ->status_is(200)
124
      ->json_like( '/0/name' => qr/$other_vendor_name/ )
100
      ->json_like( '/0/name' => qr/$other_vendor_name/ )
125
      ->json_hasnt( '/1', 'Only one vendor' );
101
      ->json_hasnt( '/1', 'Only one vendor' );
126
102
127
    $tx = $t->ua->build_tx( DELETE => '/api/v1/acquisitions/vendors/' . $other_vendor->id );
103
    $t->delete_ok( "//$userid:$password@/api/v1/acquisitions/vendors/" . $other_vendor->id )
128
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
129
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
130
    $t->request_ok($tx)
131
      ->status_is(204, 'SWAGGER3.2.4')
104
      ->status_is(204, 'SWAGGER3.2.4')
132
      ->content_is('', 'SWAGGER3.3.4');
105
      ->content_is('', 'SWAGGER3.3.4');
133
106
134
    $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors' );
107
    $t->get_ok( "//$userid:$password@/api/v1/acquisitions/vendors" )
135
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
136
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
137
    $t->request_ok($tx)
138
      ->status_is(200)
108
      ->status_is(200)
139
      ->json_is( [] );
109
      ->json_is( [] );
140
110
Lines 148-177 subtest 'get() test' => sub { Link Here
148
    $schema->storage->txn_begin;
118
    $schema->storage->txn_begin;
149
119
150
    my $vendor = $builder->build_object({ class => 'Koha::Acquisition::Booksellers' });
120
    my $vendor = $builder->build_object({ class => 'Koha::Acquisition::Booksellers' });
151
    my ( $borrowernumber, $session_id )
121
    my $nonexistent_vendor = $builder->build_object({ class => 'Koha::Acquisition::Booksellers' });
152
        = create_user_and_session( { authorized => 1 } );
122
    my $non_existent_id = $nonexistent_vendor->id;
153
123
    $nonexistent_vendor->delete;
154
    my $tx = $t->ua->build_tx( GET => "/api/v1/acquisitions/vendors/" . $vendor->id );
124
155
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
125
    my $patron = $builder->build_object({
156
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
126
        class => 'Koha::Patrons',
157
    $t->request_ok($tx)
127
        value => { flags => 2 ** 11 } ## 11 => acquisitions
128
    });
129
    my $password = 'thePassword123';
130
    $patron->set_password({ password => $password, skip_validation => 1 });
131
    my $userid = $patron->userid;
132
133
    $t->get_ok( "//$userid:$password@/api/v1/acquisitions/vendors/" . $vendor->id )
158
      ->status_is(200)
134
      ->status_is(200)
159
      ->json_is( $vendor->to_api );
135
      ->json_is( $vendor->to_api );
160
136
161
    my $non_existent_id = $vendor->id + 1;
137
    $t->get_ok( "//$userid:$password@/api/v1/acquisitions/vendors/" . $non_existent_id )
162
    $tx = $t->ua->build_tx( GET => "/api/v1/acquisitions/vendors/" . $non_existent_id );
163
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
164
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
165
    $t->request_ok($tx)
166
      ->status_is(404)
138
      ->status_is(404)
167
      ->json_is( '/error' => 'Vendor not found' );
139
      ->json_is( '/error' => 'Vendor not found' );
168
140
169
    my ( $unauthorized_borrowernumber, $unauthorized_session_id )
141
    # remove permissions
170
        = create_user_and_session( { authorized => 0 } );
142
    $patron->set({ flags => 0 })->store;
171
    $tx = $t->ua->build_tx( GET => "/api/v1/acquisitions/vendors/" . $vendor->id );
143
172
    $tx->req->cookies( { name => 'CGISESSID', value => $unauthorized_session_id } );
144
    $t->get_ok( "//$userid:$password@/api/v1/acquisitions/vendors/" . $vendor->id )
173
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
174
    $t->request_ok($tx)
175
      ->status_is(403)
145
      ->status_is(403)
176
      ->json_is( '/error', 'Authorization failure. Missing required permission(s).' );
146
      ->json_is( '/error', 'Authorization failure. Missing required permission(s).' );
177
147
Lines 184-200 subtest 'add() tests' => sub { Link Here
184
154
185
    $schema->storage->txn_begin;
155
    $schema->storage->txn_begin;
186
156
187
    my ( $unauthorized_borrowernumber, $unauthorized_session_id )
157
    my $authorized_patron = $builder->build_object({
188
        = create_user_and_session( { authorized => 0 } );
158
        class => 'Koha::Patrons',
189
    my ( $authorized_borrowernumber, $authorized_session_id )
159
        value => { flags => 2 ** 11 }
190
        = create_user_and_session( { authorized => 1 } );
160
    });
161
    my $password = 'thePassword123';
162
    $authorized_patron->set_password({ password => $password, skip_validation => 1 });
163
    my $auth_userid = $authorized_patron->userid;
164
165
    my $unauthorized_patron = $builder->build_object({
166
        class => 'Koha::Patrons',
167
        value => { flags => 0 }
168
    });
169
    $unauthorized_patron->set_password({ password => $password, skip_validation => 1 });
170
    my $unauth_userid = $unauthorized_patron->userid;
171
191
    my $vendor = { name => 'Ruben libros' };
172
    my $vendor = { name => 'Ruben libros' };
192
173
193
    # Unauthorized attempt to write
174
    # Unauthorized attempt to write
194
    my $tx = $t->ua->build_tx( POST => "/api/v1/acquisitions/vendors" => json => $vendor );
175
    $t->post_ok( "//$unauth_userid:$password@/api/v1/acquisitions/vendors" => json => $vendor )
195
    $tx->req->cookies( { name => 'CGISESSID', value => $unauthorized_session_id } );
196
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
197
    $t->request_ok($tx)
198
      ->status_is(403);
176
      ->status_is(403);
199
177
200
    # Authorized attempt to write invalid data
178
    # Authorized attempt to write invalid data
Lines 203-213 subtest 'add() tests' => sub { Link Here
203
        address5 => 'An address'
181
        address5 => 'An address'
204
    };
182
    };
205
183
206
    $tx = $t->ua->build_tx(
184
    $t->post_ok( "//$auth_userid:$password@/api/v1/acquisitions/vendors" => json => $vendor_with_invalid_field )
207
        POST => "/api/v1/acquisitions/vendors" => json => $vendor_with_invalid_field );
208
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
209
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
210
    $t->request_ok($tx)
211
      ->status_is(400)
185
      ->status_is(400)
212
      ->json_is(
186
      ->json_is(
213
        "/errors" => [
187
        "/errors" => [
Lines 218-248 subtest 'add() tests' => sub { Link Here
218
        );
192
        );
219
193
220
    # Authorized attempt to write
194
    # Authorized attempt to write
221
    $tx = $t->ua->build_tx( POST => "/api/v1/acquisitions/vendors" => json => $vendor );
195
    $t->post_ok( "//$auth_userid:$password@/api/v1/acquisitions/vendors" => json => $vendor )
222
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
196
      ->status_is( 201, 'SWAGGER3 .2.1' )
223
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
197
      ->header_like( Location => qr|^\/api\/v1\/acquisitions\/vendors/\d*|, 'SWAGGER3.4.1')
224
    my $vendor_id = $t->request_ok($tx)
198
      ->json_is( '/name' => $vendor->{name} )
225
                      ->status_is( 201, 'SWAGGER3 .2.1' )
199
      ->json_is( '/address1' => $vendor->{address1} );
226
                      ->header_like( Location => qr|^\/api\/v1\/acquisitions\/vendors/\d*|, 'SWAGGER3.4.1')
200
227
                      ->json_is( '/name' => $vendor->{name} )
201
    # read the response vendor id for later use
228
                      ->json_is( '/address1' => $vendor->{address1} )->tx->res->json('/id')
202
    my $vendor_id = $t->tx->res->json('/id');
229
        ;    # read the response vendor id for later use
230
203
231
    # Authorized attempt to create with null id
204
    # Authorized attempt to create with null id
232
    $vendor->{id} = undef;
205
    $vendor->{id} = undef;
233
    $tx = $t->ua->build_tx( POST => "/api/v1/acquisitions/vendors" => json => $vendor );
206
    $t->post_ok( "//$auth_userid:$password@/api/v1/acquisitions/vendors" => json => $vendor )
234
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
235
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
236
    $t->request_ok($tx)
237
      ->status_is(400)
207
      ->status_is(400)
238
      ->json_has('/errors');
208
      ->json_has('/errors');
239
209
240
    # Authorized attempt to create with existing id
210
    # Authorized attempt to create with existing id
241
    $vendor->{id} = $vendor_id;
211
    $vendor->{id} = $vendor_id;
242
    $tx = $t->ua->build_tx( POST => "/api/v1/acquisitions/vendors" => json => $vendor );
212
    $t->post_ok( "//$auth_userid:$password@/api/v1/acquisitions/vendors" => json => $vendor )
243
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
244
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
245
    $t->request_ok($tx)
246
      ->status_is(400)
213
      ->status_is(400)
247
      ->json_is(
214
      ->json_is(
248
        "/errors" => [
215
        "/errors" => [
Lines 261-300 subtest 'update() tests' => sub { Link Here
261
228
262
    $schema->storage->txn_begin;
229
    $schema->storage->txn_begin;
263
230
264
    my ( $unauthorized_borrowernumber, $unauthorized_session_id )
231
    my $authorized_patron = $builder->build_object({
265
        = create_user_and_session( { authorized => 0 } );
232
        class => 'Koha::Patrons',
266
    my ( $authorized_borrowernumber, $authorized_session_id )
233
        value => { flags => 2 ** 11 }
267
        = create_user_and_session( { authorized => 1 } );
234
    });
235
    my $password = 'thePassword123';
236
    $authorized_patron->set_password({ password => $password, skip_validation => 1 });
237
    my $auth_userid = $authorized_patron->userid;
238
239
    my $unauthorized_patron = $builder->build_object({
240
        class => 'Koha::Patrons',
241
        value => { flags => 0 }
242
    });
243
    $unauthorized_patron->set_password({ password => $password, skip_validation => 1 });
244
    my $unauth_userid = $unauthorized_patron->userid;
268
245
269
    my $vendor_id = $builder->build( { source => 'Aqbookseller' } )->{id};
246
    my $vendor = $builder->build_object({ class => 'Koha::Acquisition::Booksellers' } );
270
247
271
    # Unauthorized attempt to update
248
    # Unauthorized attempt to update
272
    my $tx = $t->ua->build_tx( PUT => "/api/v1/acquisitions/vendors/$vendor_id" => json =>
249
    $t->put_ok( "//$unauth_userid:$password@/api/v1/acquisitions/vendors/"
273
            { city_name => 'New unauthorized name change' } );
250
          . $vendor->id => json =>
274
    $tx->req->cookies( { name => 'CGISESSID', value => $unauthorized_session_id } );
251
          { city_name => 'New unauthorized name change' } )
275
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
276
    $t->request_ok($tx)
277
      ->status_is(403);
252
      ->status_is(403);
278
253
279
    # Attempt partial update on a PUT
254
    # Attempt partial update on a PUT
280
    my $vendor_without_mandatory_field = { address1 => 'New address' };
255
    my $vendor_without_mandatory_field = { address1 => 'New address' };
281
256
282
    $tx = $t->ua->build_tx( PUT => "/api/v1/acquisitions/vendors/$vendor_id" => json =>
257
    $t->put_ok( "//$auth_userid:$password@/api/v1/acquisitions/vendors/"
283
            $vendor_without_mandatory_field );
258
          . $vendor->id => json => $vendor_without_mandatory_field )
284
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
285
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
286
    $t->request_ok($tx)
287
      ->status_is(400)
259
      ->status_is(400)
288
      ->json_is( "/errors" => [ { message => "Missing property.", path => "/body/name" } ] );
260
      ->json_is( "/errors" => [ { message => "Missing property.", path => "/body/name" } ] );
289
261
290
    # Full object update on PUT
262
    # Full object update on PUT
291
    my $vendor_with_updated_field = { name => "London books", };
263
    my $vendor_with_updated_field = { name => "London books", };
292
264
293
    $tx = $t->ua->build_tx(
265
    $t->put_ok( "//$auth_userid:$password@/api/v1/acquisitions/vendors/"
294
        PUT => "/api/v1/acquisitions/vendors/$vendor_id" => json => $vendor_with_updated_field );
266
          . $vendor->id => json => $vendor_with_updated_field )
295
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
296
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
297
    $t->request_ok($tx)
298
      ->status_is(200)
267
      ->status_is(200)
299
      ->json_is( '/name' => 'London books' );
268
      ->json_is( '/name' => 'London books' );
300
269
Lines 306-316 subtest 'update() tests' => sub { Link Here
306
        address3 => "Address 3"
275
        address3 => "Address 3"
307
    };
276
    };
308
277
309
    $tx = $t->ua->build_tx(
278
    $t->put_ok( "//$auth_userid:$password@/api/v1/acquisitions/vendors/"
310
        PUT => "/api/v1/acquisitions/vendors/$vendor_id" => json => $vendor_with_invalid_field );
279
          . $vendor->id => json => $vendor_with_invalid_field )
311
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
312
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
313
    $t->request_ok($tx)
314
      ->status_is(400)
280
      ->status_is(400)
315
      ->json_is(
281
      ->json_is(
316
        "/errors" => [
282
        "/errors" => [
Lines 320-342 subtest 'update() tests' => sub { Link Here
320
        ]
286
        ]
321
      );
287
      );
322
288
323
    my $non_existent_id = $vendor_id + 1;
289
    my $nonexistent_vendor = $builder->build_object({ class => 'Koha::Acquisition::Booksellers' } );
324
    $tx = $t->ua->build_tx( PUT => "/api/v1/acquisitions/vendors/$non_existent_id" => json =>
290
    my $non_existent_id = $nonexistent_vendor->id;
325
            $vendor_with_updated_field );
291
    $nonexistent_vendor->delete;
326
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
292
327
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
293
    $t->put_ok( "//$auth_userid:$password@/api/v1/acquisitions/vendors/"
328
    $t->request_ok($tx)->status_is(404);
294
          . $non_existent_id => json => $vendor_with_updated_field )
295
      ->status_is(404);
329
296
330
    $schema->storage->txn_rollback;
297
    $schema->storage->txn_rollback;
331
298
332
    # Wrong method (POST)
299
    # Wrong method (POST)
333
    $vendor_with_updated_field->{id} = 2;
300
    $t->post_ok( "//$auth_userid:$password@/api/v1/acquisitions/vendors/"
334
301
          . $vendor->id => json => $vendor_with_updated_field )
335
    $tx = $t->ua->build_tx(
336
        POST => "/api/v1/acquisitions/vendors/$vendor_id" => json => $vendor_with_updated_field );
337
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
338
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
339
    $t->request_ok($tx)
340
      ->status_is(404);
302
      ->status_is(404);
341
};
303
};
342
304
Lines 346-413 subtest 'delete() tests' => sub { Link Here
346
308
347
    $schema->storage->txn_begin;
309
    $schema->storage->txn_begin;
348
310
349
    my ( $unauthorized_borrowernumber, $unauthorized_session_id )
311
    my $authorized_patron = $builder->build_object({
350
        = create_user_and_session( { authorized => 0 } );
312
        class => 'Koha::Patrons',
351
    my ( $authorized_borrowernumber, $authorized_session_id )
313
        value => { flags => 2 ** 11 }
352
        = create_user_and_session( { authorized => 1 } );
314
    });
353
315
    my $password = 'thePassword123';
354
    my $vendor_id = $builder->build( { source => 'Aqbookseller' } )->{id};
316
    $authorized_patron->set_password({ password => $password, skip_validation => 1 });
355
317
    my $auth_userid = $authorized_patron->userid;
356
    # Unauthorized attempt to update
318
357
    my $tx = $t->ua->build_tx( DELETE => "/api/v1/acquisitions/vendors/$vendor_id" );
319
    my $unauthorized_patron = $builder->build_object({
358
    $tx->req->cookies( { name => 'CGISESSID', value => $unauthorized_session_id } );
320
        class => 'Koha::Patrons',
359
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
321
        value => { flags => 0 }
360
    $t->request_ok($tx)
322
    });
323
    $unauthorized_patron->set_password({ password => $password, skip_validation => 1 });
324
    my $unauth_userid = $unauthorized_patron->userid;
325
326
    my $vendor = $builder->build_object({ class => 'Koha::Acquisition::Booksellers' } );
327
328
    # Unauthorized attempt to delete
329
    $t->delete_ok( "//$unauth_userid:$password@/api/v1/acquisitions/vendors/" . $vendor->id )
361
      ->status_is(403);
330
      ->status_is(403);
362
331
363
    $tx = $t->ua->build_tx( DELETE => "/api/v1/acquisitions/vendors/$vendor_id" );
332
    $t->delete_ok( "//$auth_userid:$password@/api/v1/acquisitions/vendors/" . $vendor->id )
364
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
365
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
366
    $t->request_ok($tx)
367
      ->status_is(204, 'SWAGGER3.2.4')
333
      ->status_is(204, 'SWAGGER3.2.4')
368
      ->content_is('', 'SWAGGER3.3.4');
334
      ->content_is('', 'SWAGGER3.3.4');
369
335
370
    $tx = $t->ua->build_tx( DELETE => "/api/v1/acquisitions/vendors/$vendor_id" );
336
    $t->delete_ok( "//$auth_userid:$password@/api/v1/acquisitions/vendors/" . $vendor->id )
371
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
372
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
373
    $t->request_ok($tx)
374
      ->status_is(404);
337
      ->status_is(404);
375
338
376
    $schema->storage->txn_rollback;
339
    $schema->storage->txn_rollback;
377
};
340
};
378
379
sub create_user_and_session {
380
381
    my $args = shift;
382
    my $flags = ( $args->{authorized} ) ? 2052 : 0;
383
384
    # my $flags = ( $args->{authorized} ) ? $args->{authorized} : 0;
385
    my $dbh = C4::Context->dbh;
386
387
    my $user = $builder->build(
388
        {   source => 'Borrower',
389
            value  => { flags => $flags }
390
        }
391
    );
392
393
    # Create a session for the authorized user
394
    my $session = C4::Auth::get_session('');
395
    $session->param( 'number',   $user->{borrowernumber} );
396
    $session->param( 'id',       $user->{userid} );
397
    $session->param( 'ip',       '127.0.0.1' );
398
    $session->param( 'lasttime', time() );
399
    $session->flush;
400
401
    if ( $args->{authorized} ) {
402
        $dbh->do(
403
            q{
404
            INSERT INTO user_permissions (borrowernumber,module_bit,code)
405
            VALUES (?,11,'vendors_manage')},
406
            undef, $user->{borrowernumber}
407
        );
408
    }
409
410
    return ( $user->{borrowernumber}, $session->id );
411
}
412
413
1;
414
- 

Return to bug 27587