View | Details | Raw Unified | Return to bug 28948
Collapse All | Expand All

(-)a/Koha/Library/Allowlist.pm (-22 lines)
Lines 1-22 Link Here
1
package Koha::Patron::Allowlist;
2
3
use Modern::Perl;
4
use parent 'Koha::Allowlist';
5
6
sub load {
7
    my ($self) = @_;
8
    my @public_read = qw(
9
      branchcode     branchname     branchaddress1
10
      branchaddress2 branchaddress3 branchzip
11
      branchcity     branchstate    branchcountry
12
      branchfax      branchemail    branchurl );
13
    $self->add(@public_read);
14
15
    my @staff_read = qw(
16
      branchillemail branchreplyto branchreturnpath
17
      branchip       branchnotes   marcorgcode
18
    );
19
    $self->add(@staff_read) if $self->{interface} eq 'staff';
20
}
21
22
1;
(-)a/Koha/Object.pm (-15 / +3 lines)
Lines 556-576 sub to_api { Link Here
556
    $params //= {};
556
    $params //= {};
557
557
558
    # Remove forbidden attributes if required
558
    # Remove forbidden attributes if required
559
    # FIXME: All modules should have a corresponding allowlist eventually
559
    if( $self->_result->can('get_column_set') ) { #FIXME Temporary measure
560
    my $allowclass = ref($self) . '::Allowlist';
560
        my $set_name = $params->{public} ? 'public_read' : 'staff_read';
561
    if ( can_load( modules => { $allowclass => undef } ) ) {
561
        $json_object = $self->filter({ input => $json_object, column_set => $set_name, log_level => 'debug' });
562
        my $allowlist = $allowclass->new(
563
            { interface => $params->{public} ? 'opac' : 'staff' } );
564
        $allowlist->load;
565
        my $blocked = $allowlist->apply( { input => $json_object } );
566
        Koha::Logger->get->debug(
567
                ref($self)
568
              . "::to_api allowlist blocked fields: "
569
              . (
570
                join ', ',
571
                map { $_ . '=' . $blocked->{$_} } sort keys %$blocked
572
              )
573
        ) if keys %$blocked;
574
    }
562
    }
575
563
576
    my $to_api_mapping = $self->to_api_mapping;
564
    my $to_api_mapping = $self->to_api_mapping;
(-)a/Koha/Schema/Result/Branch.pm (+21 lines)
Lines 901-904 sub koha_objects_class { Link Here
901
    'Koha::Libraries';
901
    'Koha::Libraries';
902
}
902
}
903
903
904
sub get_column_set {
905
    my ( $self, $name ) = @_;
906
    my $column_sets = {
907
        public_read => [qw(
908
            branchcode     branchname     branchaddress1
909
            branchaddress2 branchaddress3 branchzip
910
            branchcity     branchstate    branchcountry
911
            branchfax      branchemail    branchurl
912
        )],
913
        staff_read => [qw(
914
            branchcode     branchname     branchaddress1
915
            branchaddress2 branchaddress3 branchzip
916
            branchcity     branchstate    branchcountry
917
            branchfax      branchemail    branchurl
918
            branchillemail branchreplyto  branchreturnpath
919
            branchip       branchnotes    marcorgcode
920
        )],
921
    };
922
    return $column_sets->{$name} // [];
923
}
924
904
1;
925
1;
(-)a/t/db_dependent/Koha/Object.t (-37 / +13 lines)
Lines 31-37 use Koha::Database; Link Here
31
use Koha::Acquisition::Orders;
31
use Koha::Acquisition::Orders;
32
use Koha::DateUtils qw( dt_from_string );
32
use Koha::DateUtils qw( dt_from_string );
33
use Koha::Libraries;
33
use Koha::Libraries;
34
use Koha::Library::Allowlist;
34
use Koha::Object::ColumnSet;
35
use Koha::Patrons;
35
use Koha::Patrons;
36
use Koha::ApiKeys;
36
use Koha::ApiKeys;
37
37
Lines 376-424 subtest "to_api() tests" => sub { Link Here
376
376
377
    subtest 'unprivileged request tests' => sub {
377
    subtest 'unprivileged request tests' => sub {
378
378
379
        my @all_attrs = Koha::Libraries->columns();
379
        # Create a sample library
380
        my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load();
380
        my $library = $builder->build_object({ class => 'Koha::Libraries' });
381
        my $public_attrs = $allowlist->{_entries};
381
382
        my @all_attrs = @{ $library->_columns };
383
        my $public_attrs = { map { ( $_ => 1 ) } @{$library->_result->get_column_set('public_read')} };
384
        my $staff_attrs = { map { ( $_ => 1 ) } @{$library->_result->get_column_set('staff_read')} };
382
        my $mapping = Koha::Library->to_api_mapping;
385
        my $mapping = Koha::Library->to_api_mapping;
383
386
384
        plan tests => scalar @all_attrs * 2;
387
        plan tests => scalar @all_attrs * 2;
385
388
386
        # Create a sample library
389
        my $public_representation = $library->to_api({ public => 1 });
387
        my $library = $builder->build_object( { class => 'Koha::Libraries' } );
388
389
        my $unprivileged_representation = $library->to_api({ public => 1 });
390
        my $privileged_representation   = $library->to_api;
390
        my $privileged_representation   = $library->to_api;
391
391
392
        foreach my $attr (@all_attrs) {
392
        foreach my $attr (@all_attrs) {
393
            my $mapped = exists $mapping->{$attr} ? $mapping->{$attr} : $attr;
393
            my $mapped = $mapping->{$attr} // $attr;
394
            if ( defined($mapped) ) {
394
            is( exists $privileged_representation->{$mapped},
395
                ok(
395
                exists $staff_attrs->{$attr}, "Verify $attr in privileged" );
396
                    exists $privileged_representation->{$mapped},
396
            is( exists $public_representation->{$mapped},
397
                    "Attribute '$attr' is present when privileged"
397
                exists $public_attrs->{$attr}, "Verify $attr in public" );
398
                );
399
                if ( exists $public_attrs->{$attr} ) {
400
                    ok(
401
                        exists $unprivileged_representation->{$mapped},
402
                        "Attribute '$attr' is present when public"
403
                    );
404
                }
405
                else {
406
                    ok(
407
                        !exists $unprivileged_representation->{$mapped},
408
                        "Attribute '$attr' is not present when public"
409
                    );
410
                }
411
            }
412
            else {
413
                ok(
414
                    !exists $privileged_representation->{$attr},
415
                    "Unmapped attribute '$attr' is not present when privileged"
416
                );
417
                ok(
418
                    !exists $unprivileged_representation->{$attr},
419
                    "Unmapped attribute '$attr' is not present when public"
420
                );
421
            }
422
        }
398
        }
423
    };
399
    };
424
400
(-)a/t/db_dependent/Koha/Objects.t (-54 / +12 lines)
Lines 32-38 use Koha::Biblios; Link Here
32
use Koha::Patron::Category;
32
use Koha::Patron::Category;
33
use Koha::Patron::Categories;
33
use Koha::Patron::Categories;
34
use Koha::Patrons;
34
use Koha::Patrons;
35
use Koha::Library::Allowlist;
36
use Koha::Database;
35
use Koha::Database;
37
use Koha::DateUtils qw( dt_from_string );
36
use Koha::DateUtils qw( dt_from_string );
38
37
Lines 400-466 subtest "to_api() tests" => sub { Link Here
400
    }
399
    }
401
400
402
    subtest 'unprivileged request tests' => sub {
401
    subtest 'unprivileged request tests' => sub {
403
402
        plan tests => 4;
404
        my @all_attrs = Koha::Libraries->columns();
405
        my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load();
406
        my $public_attrs = $allowlist->{_entries};
407
        my $mapping = Koha::Library->to_api_mapping;
408
403
409
        # Create sample libraries
404
        # Create sample libraries
410
        my $library_1 = $builder->build_object({ class => 'Koha::Libraries' });
405
        my $library_1 = $builder->build_object({ class => 'Koha::Libraries' });
411
        my $library_2 = $builder->build_object({ class => 'Koha::Libraries' });
406
        my $library_2 = $builder->build_object({ class => 'Koha::Libraries' });
412
        my $libraries = Koha::Libraries->search(
407
        my $libraries = Koha::Libraries->search({
413
            {
408
            branchcode => [ $library_1->branchcode, $library_2->branchcode ],
414
                branchcode => {
409
        });
415
                    '-in' => [
416
                        $library_1->branchcode, $library_2->branchcode
417
                    ]
418
                }
419
            }
420
        );
421
422
        plan tests => scalar @all_attrs * 2 * $libraries->count;
423
410
424
        my $libraries_unprivileged_representation = $libraries->to_api({ public => 1 });
411
        my $libraries_unprivileged_representation = $libraries->to_api({ public => 1 });
425
        my $libraries_privileged_representation   = $libraries->to_api();
412
        my $libraries_privileged_representation   = $libraries->to_api();
413
        my $mapping = Koha::Library->to_api_mapping;
426
414
427
        for (my $i = 0; $i < $libraries->count; $i++) {
415
        my $public_attrs = [ sort map { $mapping->{$_} //$_ } @{$library_1->_result->get_column_set('public_read')} ];
428
            my $privileged_representation   = $libraries_privileged_representation->[$i];
416
        is_deeply( [ sort keys %{$libraries_unprivileged_representation->[0]} ], $public_attrs, 'Check first, public' );
429
            my $unprivileged_representation = $libraries_unprivileged_representation->[$i];
417
        is_deeply( [ sort keys %{$libraries_unprivileged_representation->[1]} ], $public_attrs, 'Check second, public' );
430
            foreach my $attr (@all_attrs) {
431
                my $mapped = exists $mapping->{$attr} ? $mapping->{$attr} : $attr;
432
                if ( defined($mapped) ) {
433
                    ok(
434
                        exists $privileged_representation->{$mapped},
435
                        "Attribute '$attr' is present when privileged"
436
                    );
437
                    if ( exists $public_attrs->{$attr} ) {
438
                        ok(
439
                            exists $unprivileged_representation->{$mapped},
440
                            "Attribute '$attr' is present when public"
441
                        );
442
                    }
443
                    else {
444
                        ok(
445
                            !exists $unprivileged_representation->{$mapped},
446
                            "Attribute '$attr' is not present when public"
447
                        );
448
                    }
449
                }
450
                else {
451
                    ok(
452
                        !exists $privileged_representation->{$attr},
453
                        "Unmapped attribute '$attr' is not present when privileged"
454
                    );
455
                    ok(
456
                        !exists $unprivileged_representation->{$attr},
457
                        "Unmapped attribute '$attr' is not present when public"
458
                    );
459
                }
460
            }
461
        }
462
    };
463
418
419
        my $staff_attrs = [ sort map { $mapping->{$_} //$_ } @{$library_1->_result->get_column_set('staff_read')} ];
420
        is_deeply( [ sort keys %{$libraries_privileged_representation->[0]} ], $staff_attrs, 'Check first, staff' );
421
        is_deeply( [ sort keys %{$libraries_privileged_representation->[1]} ], $staff_attrs, 'Check second, staff' );
422
    };
464
423
465
    $schema->storage->txn_rollback;
424
    $schema->storage->txn_rollback;
466
};
425
};
467
- 

Return to bug 28948