View | Details | Raw Unified | Return to bug 27947
Collapse All | Expand All

(-)a/Koha/REST/V1/ArticleRequests.pm (-2 / +4 lines)
Lines 66-72 sub cancel { Link Here
66
    };
66
    };
67
}
67
}
68
68
69
=head3 patron_cancel
69
=head3 patron_cancel (public route)
70
70
71
Controller function that handles cancelling a patron's Koha::ArticleRequest object
71
Controller function that handles cancelling a patron's Koha::ArticleRequest object
72
72
Lines 84-89 sub patron_cancel { Link Here
84
        );
84
        );
85
    }
85
    }
86
86
87
    # patron_id has been validated by the allow-owner check, so the following call to related
88
    # article requests covers the case of article requests not belonging to the patron
87
    my $article_request = $patron->article_requests->find( $c->validation->param('article_request_id') );
89
    my $article_request = $patron->article_requests->find( $c->validation->param('article_request_id') );
88
90
89
    unless ( $article_request ) {
91
    unless ( $article_request ) {
Lines 109-112 sub patron_cancel { Link Here
109
    };
111
    };
110
}
112
}
111
113
112
1;
114
1;
(-)a/api/v1/swagger/paths/article_requests.yaml (+3 lines)
Lines 51-56 Link Here
51
        description: Under maintenance
51
        description: Under maintenance
52
        schema:
52
        schema:
53
          $ref: ../definitions.json#/error
53
          $ref: ../definitions.json#/error
54
    x-koha-authorization:
55
      permissions:
56
        circulate: circulate_remaining_permissions
54
"/public/patrons/{patron_id}/article_requests/{article_request_id}":
57
"/public/patrons/{patron_id}/article_requests/{article_request_id}":
55
  delete:
58
  delete:
56
    x-mojo-to: ArticleRequests#patron_cancel
59
    x-mojo-to: ArticleRequests#patron_cancel
(-)a/t/db_dependent/api/v1/article_requests.t (-12 / +16 lines)
Lines 40-46 subtest 'cancel() tests' => sub { Link Here
40
    my $authorized_patron = $builder->build_object(
40
    my $authorized_patron = $builder->build_object(
41
        {
41
        {
42
            class => 'Koha::Patrons',
42
            class => 'Koha::Patrons',
43
            value => { flags => 1 }
43
            value => { flags => 2 ** 1 } # circulate flag = 1
44
        }
44
        }
45
    );
45
    );
46
    my $password = 'thePassword123';
46
    my $password = 'thePassword123';
Lines 80-86 subtest 'cancel() tests' => sub { Link Here
80
80
81
subtest 'patron_cancel() tests' => sub {
81
subtest 'patron_cancel() tests' => sub {
82
82
83
    plan tests => 12;
83
    plan tests => 14;
84
84
85
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
85
    t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
86
    t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
86
    t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
Lines 90-96 subtest 'patron_cancel() tests' => sub { Link Here
90
    my $patron = $builder->build_object(
90
    my $patron = $builder->build_object(
91
        {
91
        {
92
            class => 'Koha::Patrons',
92
            class => 'Koha::Patrons',
93
            value => { privacy_guarantor_checkouts => 0 }
93
            value => { flags => 0 }
94
        }
94
        }
95
    );
95
    );
96
    my $password = 'thePassword123';
96
    my $password = 'thePassword123';
Lines 102-116 subtest 'patron_cancel() tests' => sub { Link Here
102
    my $deleted_article_request_id = $deleted_article_request->id;
102
    my $deleted_article_request_id = $deleted_article_request->id;
103
    $deleted_article_request->delete;
103
    $deleted_article_request->delete;
104
104
105
    # delete non existent article request
106
    $t->delete_ok("//$userid:$password@/api/v1/public/patrons/$patron_id/article_requests/$deleted_article_request_id")
107
      ->status_is(404)
108
      ->json_is( { error => "Article request not found" } );
109
105
    my $another_patron = $builder->build_object({ class => 'Koha::Patrons' });
110
    my $another_patron = $builder->build_object({ class => 'Koha::Patrons' });
106
    my $another_patron_id = $another_patron->id;
111
    my $another_patron_id = $another_patron->id;
107
112
108
    $t->delete_ok("//$userid:$password@/api/v1/public/patrons/$another_patron_id/article_requests/$deleted_article_request_id")
113
    my $article_request_2 = $builder->build_object({ class => 'Koha::ArticleRequests', value => { borrowernumber => $another_patron_id } });
109
      ->status_is(403);
110
114
111
    $t->delete_ok("//$userid:$password@/api/v1/public/patrons/$patron_id/article_requests/$deleted_article_request_id")
115
    # delete another patron's request
112
      ->status_is(404)
116
    $t->delete_ok("//$userid:$password@/api/v1/public/patrons/$another_patron_id/article_requests/" . $article_request_2->id)
113
      ->json_is( { error => "Article request not found" } );
117
      ->status_is(403)
118
      ->json_is( '/error' => 'Authorization failure. Missing required permission(s).' );
114
119
115
    my $another_article_request = $builder->build_object(
120
    my $another_article_request = $builder->build_object(
116
        {
121
        {
Lines 119-127 subtest 'patron_cancel() tests' => sub { Link Here
119
        }
124
        }
120
    );
125
    );
121
126
122
    $t->delete_ok("//$userid:$password@/api/v1/public/patrons/$patron_id/article_requests/$another_article_request")
127
    $t->delete_ok("//$userid:$password@/api/v1/public/patrons/$patron_id/article_requests/" . $another_article_request->id)
123
      ->status_is(403);
128
      ->status_is(404)
124
129
      ->json_is( { error => 'Article request not found' } );
125
130
126
    my $article_request = $builder->build_object(
131
    my $article_request = $builder->build_object(
127
        {
132
        {
128
- 

Return to bug 27947