From e0bf2983810ae625d1ffacbe979e845a633c9202 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Fri, 26 Nov 2021 15:35:05 +0000
Subject: [PATCH] Bug 29523: Pass the logged user around and use for validating

In this patch I add 'user', containing the Koha::Patron object for the
logged in user in the params hash we pass around in to_api. I then use
that in a new 'is_accessible_in_context' method added to Koha::Patron.

The method name is a bit of a mouthfull.. it could be 'is_limited' as
it's really the equivilent of 'search_limited' in the plural class.. but
I wasn't sure that was actually clearer... if we like it we could strip
back out some of the work around search_related.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
---
 Koha/Object.pm              | 20 ++++++--------------
 Koha/Patron.pm              | 24 ++++++++++++++++++++++++
 Koha/REST/Plugin/Objects.pm |  4 ++--
 3 files changed, 32 insertions(+), 16 deletions(-)

diff --git a/Koha/Object.pm b/Koha/Object.pm
index fe281dd58d..855f733f08 100644
--- a/Koha/Object.pm
+++ b/Koha/Object.pm
@@ -552,7 +552,7 @@ Returns a representation of the object, suitable for API output.
 sub to_api {
     my ( $self, $params ) = @_;
 
-    return unless $self->accessible;
+    return unless $self->is_accessible_in_context($params);
 
     my $json_object = $self->TO_JSON;
 
@@ -938,26 +938,18 @@ sub _handle_to_api_child {
     return $res;
 }
 
-=head3 accessible
+=head3 is_accessible_in_context
 
-    if ( $object->accessible ) { ... }
+    if ( $object->is_accessible_in_context ) { ... }
 
-Whether the object should be accessible in the current context (requesting user).
-It relies on the plural class properly implementing the I<search_limited> method.
+Stub method that is expected to be overloaded (if required) by implementing classes.
 
 =cut
 
-sub accessible {
+sub is_accessible_in_context {
     my ($self) = @_;
 
-    return $self->_get_objects_class->search_limited(
-        {
-            map { $_ => $self->$_ }
-              $self->_result->result_source->primary_columns
-        }
-      )->count > 0
-      ? 1
-      : 0;
+    return 1;
 }
 
 sub DESTROY { }
diff --git a/Koha/Patron.pm b/Koha/Patron.pm
index adf916b5ea..284e52f296 100644
--- a/Koha/Patron.pm
+++ b/Koha/Patron.pm
@@ -1752,6 +1752,30 @@ sub get_extended_attribute {
     return $attribute->next;
 }
 
+=head3 is_accessible_in_context
+
+    if ( $patron->is_accessible_in_context({ user => $logged_in_user }) ) { ... }
+
+This overloaded method validates wether the current I<Koha::Patron> object can be accessed
+by the logged in user.
+
+Returns 0 if the I<user> parameter is missing.
+
+=cut
+
+sub is_accessible_in_context {
+    my ( $self, $params ) = @_;
+
+    # FIXME? It felt tempting to return 0 instead
+    # but it would mean needing to explicitly add the 'user'
+    # param in all tests...
+    return 1
+      unless $params->{user};
+
+    my $consumer = $params->{user};
+    return $consumer->can_see_patron_infos($self);
+}
+
 =head3 to_api
 
     my $json = $patron->to_api;
diff --git a/Koha/REST/Plugin/Objects.pm b/Koha/REST/Plugin/Objects.pm
index ddf2194530..ef58e09189 100644
--- a/Koha/REST/Plugin/Objects.pm
+++ b/Koha/REST/Plugin/Objects.pm
@@ -66,7 +66,7 @@ the requested object. It passes through any embeds if specified.
 
             return unless $object;
 
-            return $object->to_api({ embed => $embed });
+            return $object->to_api({ embed => $embed, user => $c->stash('koha.user') });
         }
     );
 
@@ -164,7 +164,7 @@ for API rendering.
                 }
             );
 
-            return $objects->to_api({ embed => $embed, public => $is_public });
+            return $objects->to_api({ embed => $embed, public => $is_public, user => $c->stash('koha.user') });
         }
     );
 }
-- 
2.34.1