@@ -, +, @@ --- Koha/Object.pm | 20 ++++++-------------- Koha/Patron.pm | 24 ++++++++++++++++++++++++ Koha/REST/Plugin/Objects.pm | 4 ++-- 3 files changed, 32 insertions(+), 16 deletions(-) --- a/Koha/Object.pm +++ a/Koha/Object.pm @@ -552,7 +552,7 @@ Returns a representation of the object, suitable for API output. sub to_api { my ( $self, $params ) = @_; - return unless $self->accessible; + return unless $self->is_accessible_in_context($params); my $json_object = $self->TO_JSON; @@ -938,26 +938,18 @@ sub _handle_to_api_child { return $res; } -=head3 accessible +=head3 is_accessible_in_context - if ( $object->accessible ) { ... } + if ( $object->is_accessible_in_context ) { ... } -Whether the object should be accessible in the current context (requesting user). -It relies on the plural class properly implementing the I method. +Stub method that is expected to be overloaded (if required) by implementing classes. =cut -sub accessible { +sub is_accessible_in_context { my ($self) = @_; - return $self->_get_objects_class->search_limited( - { - map { $_ => $self->$_ } - $self->_result->result_source->primary_columns - } - )->count > 0 - ? 1 - : 0; + return 1; } sub DESTROY { } --- a/Koha/Patron.pm +++ a/Koha/Patron.pm @@ -1752,6 +1752,30 @@ sub get_extended_attribute { return $attribute->next; } +=head3 is_accessible_in_context + + if ( $patron->is_accessible_in_context({ user => $logged_in_user }) ) { ... } + +This overloaded method validates wether the current I object can be accessed +by the logged in user. + +Returns 0 if the I parameter is missing. + +=cut + +sub is_accessible_in_context { + my ( $self, $params ) = @_; + + # FIXME? It felt tempting to return 0 instead + # but it would mean needing to explicitly add the 'user' + # param in all tests... + return 1 + unless $params->{user}; + + my $consumer = $params->{user}; + return $consumer->can_see_patron_infos($self); +} + =head3 to_api my $json = $patron->to_api; --- a/Koha/REST/Plugin/Objects.pm +++ a/Koha/REST/Plugin/Objects.pm @@ -66,7 +66,7 @@ the requested object. It passes through any embeds if specified. return unless $object; - return $object->to_api({ embed => $embed }); + return $object->to_api({ embed => $embed, user => $c->stash('koha.user') }); } ); @@ -164,7 +164,7 @@ for API rendering. } ); - return $objects->to_api({ embed => $embed, public => $is_public }); + return $objects->to_api({ embed => $embed, public => $is_public, user => $c->stash('koha.user') }); } ); } --