From 88d77dea66d97a6147fb82eb1d785cf658262560 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Mon, 18 Jul 2022 13:32:23 +0100 Subject: [PATCH] Bug 30979: Checkout API's This patch adds an initial framework for adding/migrating AddIssue from C4::Circulation into Koha::Checkout... but that feels a bit over scope. Also.. should we do all the checks and return failure in Koha::REST::V1::Checkout->add such that we require a new special header for the equivilent of 'confirm' in the controller script route.. Should we accept an external_id in the checkout add route.. or chain two ajax requests such that the first looks up the item from it's external_id and then the second calls checkout upon it? Should we have a 'CanBookBeIssued' equivilent on the API? Bug 30979: Add confirmation token to API This patch adds the creation of a confirmation token to the get_availability method and then adds a test for the presence of that same token later in the checkout routine. --- C4/Circulation.pm | 2 +- Koha/Item.pm | 1 - Koha/REST/V1/Checkouts.pm | 152 +++++++++++++++++++++++++++- api/v1/swagger/paths/checkouts.yaml | 128 +++++++++++++++++++++++ api/v1/swagger/swagger.yaml | 9 ++ 5 files changed, 289 insertions(+), 3 deletions(-) diff --git a/C4/Circulation.pm b/C4/Circulation.pm index 6faf53add9..9ff0b1f5d4 100644 --- a/C4/Circulation.pm +++ b/C4/Circulation.pm @@ -774,7 +774,7 @@ sub CanBookBeIssued { my $onsite_checkout = $params->{onsite_checkout} || 0; my $override_high_holds = $params->{override_high_holds} || 0; - my $item_object = Koha::Items->find({barcode => $barcode }); + my $item_object = $params->{item} // Koha::Items->find({barcode => $barcode }); # MANDATORY CHECKS - unless item exists, nothing else matters unless ( $item_object ) { diff --git a/Koha/Item.pm b/Koha/Item.pm index 610315ac11..a089b45cb6 100644 --- a/Koha/Item.pm +++ b/Koha/Item.pm @@ -337,7 +337,6 @@ sub move_to_deleted { return Koha::Database->new->schema->resultset('Deleteditem')->create($item_infos); } - =head3 effective_itemtype Returns the itemtype for the item based on whether item level itemtypes are set or not. diff --git a/Koha/REST/V1/Checkouts.pm b/Koha/REST/V1/Checkouts.pm index e4a52b4cad..e0745668b3 100644 --- a/Koha/REST/V1/Checkouts.pm +++ b/Koha/REST/V1/Checkouts.pm @@ -19,10 +19,13 @@ use Modern::Perl; use Mojo::Base 'Mojolicious::Controller'; use Mojo::JSON; +use Mojo::JWT; +use Digest::MD5 qw( md5_base64 ); +use Encode; use C4::Auth qw( haspermission ); use C4::Context; -use C4::Circulation qw( AddRenewal ); +use C4::Circulation qw( CanBookBeIssued AddIssue AddRenewal ); use Koha::Checkouts; use Koha::Old::Checkouts; @@ -99,6 +102,153 @@ sub get { }; } +=head3 get_availablity + +Controller function that handles retrieval of Checkout availability + +=cut + +sub get_availability { + my $c = shift->openapi->valid_input or return; + + my $patron = Koha::Patrons->find( $c->validation->param('patron_id') ); + my $inprocess = 0; # What does this do? + my $ignore_reserves = 0; # Don't ignore reserves + my $item = Koha::Items->find( $c->validation->param('item_id') ); + my $params = { + item => $item + }; + + my ( $impossible, $confirmation, $alerts, $messages ) = + CanBookBeIssued( $patron, undef, undef, $inprocess, $ignore_reserves, + $params ); + + my $token; + if (keys %{$confirmation}) { + my $claims = { map { $_ => 1 } keys %{$confirmation} }; + my $secret = + md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ); + $token = Mojo::JWT->new( claims => $claims, secret => $secret )->encode; + } + + my $response = { + blockers => $impossible, + confirms => $confirmation, + warnings => { %{$alerts}, %{$messages} }, + confirmation_token => $token + }; + + return $c->render( status => 200, openapi => $response ); +} + +=head3 add + +Add a new checkout + +=cut + +sub add { + my $c = shift->openapi->valid_input or return; + + my $params = $c->validation->param('body'); + my $item_id = $params->{item_id}; + my $patron_id = $params->{patron_id}; + my $onsite = $params->{onsite_checkout}; + + return try { + my $item = Koha::Items->find( $item_id ); + unless ($item) { + return $c->render( + status => 409, + openapi => { + error => 'Item not found', + error_code => 'ITEM_NOT_FOUND', + } + ); + } + + my $patron = Koha::Patrons->find( $patron_id ); + unless ($patron) { + return $c->render( + status => 409, + openapi => { + error => 'Patron not found', + error_code => 'PATRON_NOT_FOUND', + } + ); + } + + my $inprocess = 0; # What does this do? + my $ignore_reserves = 0; # Don't ignore reserves + my $params = { + item => $item + }; + + # Call 'CanBookBeIssued' + my ( $impossible, $confirmation, $alerts, $messages ) = + CanBookBeIssued( $patron, undef, undef, $inprocess, $ignore_reserves, + $params ); + + # * Fail for blockers - render 403 + if (keys %{$impossible}) { + my @errors = keys %{$impossible}; + return $c->render( + status => 403, + openapi => { error => "Checkout not authorized (@errors)" } + ); + } + + # * If confirmation required, check variable set above - render 412 if variable is false + if (keys %{$confirmation}) { + my $confirmed = 0; + + # Check for existance of confirmation token and if exists check validity + if ( my $token = $c->validation->param('confirmation') ) { + my $secret = + md5_base64( + Encode::encode( 'UTF-8', C4::Context->config('pass') ) ); + my $claims = try { + Mojo::JWT->new( secret => $secret )->decode($token); + } catch { + return $c->render( + status => 403, + openapi => + { error => "Confirmation required" } + ); + }; + + # check claims match + my $token_claims = join( / /, sort keys %{$claims} ); + my $confirm_keys = join( / /, sort keys %{$confirmation} ); + $confirmed = 1 if ( $token_claims eq $confirm_keys ); + } + + unless ($confirmed) { + return $c->render( + status => 412, + openapi => { error => "Confirmation error" } + ); + } + } + + # Call 'AddIssue' + my $checkout = AddIssue($patron->unblessed, $item->barcode); + + # Check return of AddIssue + # Get checkout from AddIssue - render 201 + # Get error from AddIssue - render 400? + + $c->res->headers->location( $c->req->url->to_string . '/' . $checkout->id ); + return $c->render( + status => 201, + openapi => $checkout->to_api + ); + } + catch { + $c->unhandled_exception($_); + }; +} + =head3 get_renewals List Koha::Checkout::Renewals diff --git a/api/v1/swagger/paths/checkouts.yaml b/api/v1/swagger/paths/checkouts.yaml index 82c67bf324..6f1d0cb760 100644 --- a/api/v1/swagger/paths/checkouts.yaml +++ b/api/v1/swagger/paths/checkouts.yaml @@ -61,6 +61,53 @@ x-koha-authorization: permissions: circulate: circulate_remaining_permissions + post: + x-mojo-to: Checkouts#add + operationId: addCheckout + tags: + - checkouts + summary: Add a new checkout + parameters: + - name: body + in: body + description: A JSON object containing informations about the new checkout + required: true + schema: + $ref: "../swagger.yaml#/definitions/checkout" + produces: + - application/json + responses: + "201": + description: Created new checkout + schema: + $ref: "../swagger.yaml#/definitions/checkout" + "403": + description: Cannot create checkout + schema: + $ref: "../swagger.yaml#/definitions/error" + "404": + description: Checkout not found + schema: + $ref: "../swagger.yaml#/definitions/error" + "409": + description: Conflict in creating resource + schema: + $ref: "../swagger.yaml#/definitions/error" + "412": + description: Precondition failed + schema: + $ref: "../swagger.yaml#/definitions/error" + "500": + description: | + Internal server error. Possible `error_code` attribute values: + + * `internal_server_error` + schema: + $ref: "../swagger.yaml#/definitions/error" + "503": + description: Under maintenance + schema: + $ref: "../swagger.yaml#/definitions/error" "/checkouts/{checkout_id}": get: x-mojo-to: Checkouts#get @@ -275,3 +322,84 @@ x-koha-authorization: permissions: circulate: circulate_remaining_permissions +"/public/checkouts": + post: + x-mojo-to: Checkouts#add + operationId: addCheckoutPublic + tags: + - checkouts + summary: Add a new checkout + parameters: + - name: body + in: body + description: A JSON object containing informations about the new checkout + required: true + schema: + $ref: "../swagger.yaml#/definitions/checkout" + - name: confirmation + in: query + description: A JWT confirmation token + required: false + type: string + produces: + - application/json + responses: + "201": + description: Created new checkout + schema: + $ref: "../swagger.yaml#/definitions/checkout" + "403": + description: Cannot create checkout + schema: + $ref: "../swagger.yaml#/definitions/error" + "404": + description: Checkout not found + schema: + $ref: "../swagger.yaml#/definitions/error" + "412": + description: Confirmaion required + schema: + $ref: "../swagger.yaml#/definitions/error" + "500": + description: | + Internal server error. Possible `error_code` attribute values: + + * `internal_server_error` + schema: + $ref: "../swagger.yaml#/definitions/error" + "503": + description: Under maintenance + schema: + $ref: "../swagger.yaml#/definitions/error" +"/public/checkouts/availability": + get: + x-mojo-to: Checkouts#get_availability + operationId: availabilityCheckoutsPublic + tags: + - checkouts + summary: Get checkout availability + parameters: + - $ref: "../swagger.yaml#/parameters/patron_id_qp" + - $ref: "../swagger.yaml#/parameters/item_id_qp" + produces: + - application/json + responses: + "200": + description: Availability + schema: + type: "object" + "403": + description: Access forbidden + schema: + $ref: "../swagger.yaml#/definitions/error" + "500": + description: | + Internal server error. Possible `error_code` attribute values: + + * `internal_server_error` + schema: + $ref: "../swagger.yaml#/definitions/error" + "503": + description: Under maintenance + schema: + $ref: "../swagger.yaml#/definitions/error" diff --git a/api/v1/swagger/swagger.yaml b/api/v1/swagger/swagger.yaml index 6ad7a24ec7..352a0452ee 100644 --- a/api/v1/swagger/swagger.yaml +++ b/api/v1/swagger/swagger.yaml @@ -211,6 +211,10 @@ paths: $ref: "./paths/patrons_password.yaml#/~1patrons~1{patron_id}~1password~1expiration_date" "/public/biblios/{biblio_id}": $ref: "./paths/biblios.yaml#/~1public~1biblios~1{biblio_id}" + "/public/checkouts": + $ref: ./paths/checkouts.yaml#/~1public~1checkouts + "/public/checkouts/availability": + $ref: ./paths/checkouts.yaml#/~1public~1checkouts~1availability "/public/items": $ref: "./paths/items.yaml#/~1public~1items" "/public/biblios/{biblio_id}/items": @@ -334,6 +338,11 @@ parameters: name: item_id required: true type: integer + item_id_qp: + description: Internal item identifier + in: query + name: item_id + type: integer job_id_pp: description: Job internal identifier in: path -- 2.20.1