From 90c785a5e66cca7a60f85e9f84fd55dda9718b24 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Fri, 17 Sep 2021 17:09:58 +0100 Subject: [PATCH] Bug 27947: (QA follow-up) Update test to highlight issue This addition to the tests highlights a permissions/security check error. --- t/db_dependent/api/v1/article_requests.t | 31 ++++++++++++++++-------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/t/db_dependent/api/v1/article_requests.t b/t/db_dependent/api/v1/article_requests.t index 5f9ae1cd4e..9518f42737 100755 --- a/t/db_dependent/api/v1/article_requests.t +++ b/t/db_dependent/api/v1/article_requests.t @@ -48,13 +48,13 @@ subtest 'cancel() tests' => sub { { password => $password, skip_validation => 1 } ); my $userid = $authorized_patron->userid; - my $deleted_article_requet = + my $deleted_article_request = $builder->build_object( { class => 'Koha::ArticleRequests' } ); - my $deleted_article_requet_id = $deleted_article_requet->id; - $deleted_article_requet->delete; + my $deleted_article_request_id = $deleted_article_request->id; + $deleted_article_request->delete; $t->delete_ok( -"//$userid:$password@/api/v1/article_requests/$deleted_article_requet_id" +"//$userid:$password@/api/v1/article_requests/$deleted_article_request_id" )->status_is(404)->json_is( { error => "Article request not found" } ); my $article_request = @@ -80,7 +80,7 @@ subtest 'cancel() tests' => sub { subtest 'patron_cancel() tests' => sub { - plan tests => 10; + plan tests => 12; t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 ); t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 ); @@ -98,20 +98,31 @@ subtest 'patron_cancel() tests' => sub { my $userid = $patron->userid; my $patron_id = $patron->borrowernumber; - my $deleted_article_requet = $builder->build_object( { class => 'Koha::ArticleRequests' } ); - my $deleted_article_requet_id = $deleted_article_requet->id; - $deleted_article_requet->delete; + my $deleted_article_request = $builder->build_object( { class => 'Koha::ArticleRequests', value => { borrowernumber => $patron_id } } ); + my $deleted_article_request_id = $deleted_article_request->id; + $deleted_article_request->delete; my $another_patron = $builder->build_object({ class => 'Koha::Patrons' }); my $another_patron_id = $another_patron->id; - $t->delete_ok("//$userid:$password@/api/v1/public/patrons/$another_patron_id/article_requests/$deleted_article_requet_id") + $t->delete_ok("//$userid:$password@/api/v1/public/patrons/$another_patron_id/article_requests/$deleted_article_request_id") ->status_is(403); - $t->delete_ok("//$userid:$password@/api/v1/public/patrons/$patron_id/article_requests/$deleted_article_requet_id") + $t->delete_ok("//$userid:$password@/api/v1/public/patrons/$patron_id/article_requests/$deleted_article_request_id") ->status_is(404) ->json_is( { error => "Article request not found" } ); + my $another_article_request = $builder->build_object( + { + class => 'Koha::ArticleRequests', + value => { borrowernumber => $another_patron->id } + } + ); + + $t->delete_ok("//$userid:$password@/api/v1/public/patrons/$patron_id/article_requests/$another_article_request") + ->status_is(403); + + my $article_request = $builder->build_object( { class => 'Koha::ArticleRequests', -- 2.20.1