View | Details | Raw Unified | Return to bug 31380
Collapse All | Expand All

(-)a/Koha/Auth.pm (+88 lines)
Line 0 Link Here
1
package Koha::Auth;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use C4::Auth qw//;
21
use Koha::Patrons;
22
23
=head1 NAME
24
25
Koha::Auth - Koha class for handling authentication and authorization
26
27
=head1 SYNOPSIS
28
29
=head2 METHODS
30
31
=head3 authenticate
32
33
    my $user = Koha::Auth->authenticate({
34
        sessionID => $sessionID,
35
    });
36
37
Verifies that this user has an authenticated Koha session
38
39
=cut
40
41
sub authenticate {
42
    my ( $class, $args ) = @_;
43
    my ( $auth_user, $auth_session );
44
    my $sessionID = $args->{sessionID};
45
    if ($sessionID) {
46
        my $flags;
47
        my ( $return, $session, $more_info ) = C4::Auth::check_cookie_auth(
48
            $sessionID, $flags,
49
            { remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 }
50
        );
51
        if ( $return && $return eq 'ok' && $session ) {
52
            my $userid = $session->param('id');
53
            if ($userid) {
54
                my $patron = Koha::Patrons->find( { userid => $userid } );
55
                if ($patron) {
56
                    $auth_user    = $patron;
57
                    $auth_session = $session;
58
                }
59
            }
60
        }
61
    }
62
    return ( $auth_user, $auth_session );
63
}
64
65
=head3 authorize
66
67
    my $flags = Koha::Auth->authorize({
68
        session => $session,
69
        flagsrequired => { self_check => 'self_checkout_module' },
70
    });
71
72
=cut
73
74
sub authorize {
75
    my ( $class, $args ) = @_;
76
    my $flags         = 0;
77
    my $session       = $args->{session};
78
    my $flagsrequired = $args->{flagsrequired};
79
    if ($session) {
80
        my $userid = $session->param('id');
81
        if ($userid) {
82
            $flags = C4::Auth::haspermission( $userid, $flagsrequired );
83
        }
84
    }
85
    return $flags;
86
}
87
88
1;
(-)a/Koha/Mojo/Plugins/Core.pm (+131 lines)
Line 0 Link Here
1
package Koha::Mojo::Plugins::Core;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use Mojo::Base 'Mojolicious::Plugin';
21
22
use Koha::Auth;
23
use Koha::Auth::Permissions;
24
use Koha::Template;
25
26
use Koha::Exceptions;
27
use Koha::Exceptions::Authorization;
28
29
=head1 NAME
30
31
Koha::Mojo::Plugins::Core - Mojolicious plugin that adds AuthZ and
32
    template helpers for Koha Mojolicious controllers
33
34
=head1 SYNOPSIS
35
36
=head2 METHODS
37
38
=head3 register
39
40
=cut
41
42
sub register {
43
    my ( $self, $app, $conf ) = @_;
44
45
    $app->helper(
46
        'koha.authenticate' => sub {
47
            my ( $c, $args ) = @_;
48
            my $authenticated = 0;
49
            my $sessionID     = $c->cookie('CGISESSID');
50
            my ( $user, $session ) = Koha::Auth->authenticate(
51
                {
52
                    sessionID => $sessionID,
53
                }
54
            );
55
            if ( $user && $session ) {
56
                $c->stash->{__koha_user__}    = $user;
57
                $c->stash->{__koha_session__} = $session;
58
                $c->cookie(
59
                    'CGISESSID' => $session->id,
60
                    {
61
                        httponly => 1,
62
                        secure   => ( C4::Context->https_enabled() ? 1 : 0 ),
63
                        path     => '/',
64
                    }
65
                );
66
                $authenticated = 1;
67
            }
68
            return $authenticated;
69
        }
70
    );
71
72
    $app->helper(
73
        'koha.authorize' => sub {
74
            my ( $c, $args ) = @_;
75
            my $session = $c->stash->{__koha_session__};
76
            my $flags   = Koha::Auth->authorize(
77
                {
78
                    session       => $session,
79
                    flagsrequired => $args->{flagsrequired},
80
                }
81
            );
82
            if ($flags) {
83
                $c->stash->{__koha_flags__} = $flags;
84
                $c->stash->{__koha_authz__} = Koha::Auth::Permissions->get_authz_from_flags( { flags => $flags } );
85
                return ( $flags, $c->stash->{__koha_user__} );
86
            } else {
87
                Koha::Exceptions::Authorization::Unauthorized->throw(
88
                    error                => "Authorization failure. Missing required permission(s).",
89
                    required_permissions => $args->{flagsrequired},
90
                );
91
            }
92
        }
93
    );
94
95
    $app->helper(
96
        'koha.template' => sub {
97
            my ( $c, $args ) = @_;
98
            my $template_filename = $args->{template_filename};
99
            my $interface         = $args->{interface};
100
            my $template          = Koha::Template::prepare_template(
101
                {
102
                    template_filename => $template_filename,
103
                    interface         => $interface,
104
                    koha_session      => $c->stash->{__koha_session__},
105
                    koha_user         => $c->stash->{__koha_user__},
106
                    koha_authz        => $c->stash->{__koha_authz__},
107
                }
108
            );
109
            return $template;
110
        }
111
    );
112
113
    $app->helper(
114
        'koha.render_staff_error' => sub {
115
            my ( $c, $args ) = @_;
116
            my $status = $args->{status} // 500;
117
            my ( $flags, $loggedinuser ) = $c->koha->authorize( { flagsrequired => { catalogue => 1, } } );
118
            my $template = $c->koha->template(
119
                {
120
                    template_filename => 'errors/errorpage.tt',
121
                    interface         => 'intranet',
122
                }
123
            );
124
            $template->{VARS}->{errno} = $status;
125
            $template->{VARS}->{admin} = C4::Context->preference('KohaAdminEmailAddress');
126
            return $c->render( text => $template->output(), status => $status );
127
        }
128
    );
129
}
130
131
1;
(-)a/Koha/Mojo/Staff.pm (+90 lines)
Line 0 Link Here
1
package Koha::Mojo::Staff;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Mojo::Base 'Mojolicious';
19
20
use C4::Context;
21
use Try::Tiny qw( catch try );
22
23
=head1 NAME
24
25
Koha::Mojo::Staff - Mojolicious application for Koha staff interface
26
27
=head1 SYNOPSIS
28
29
=head2 METHODS
30
31
=head3 startup
32
33
=cut
34
35
sub startup {
36
    my $self = shift;
37
38
    #NOTE: Load plugin which sets up core helper methods needed for any Koha app
39
    $self->plugin('Koha::Mojo::Plugins::Core');
40
41
    #NOTE: Customize application-wide exception handling
42
    $self->hook(
43
        around_dispatch => sub {
44
            my ( $next, $c ) = @_;
45
            try {
46
                $next->();
47
            } catch {
48
                my $status = 500;
49
                if ( $_->isa('Koha::Exceptions::Authorization::Unauthorized') ) {
50
                    $status = 403;
51
                }
52
                $c->koha->render_staff_error( { status => $status } );
53
            };
54
        }
55
    );
56
57
    # Router
58
    my $r = $self->routes;
59
60
    #NOTE: The /login route is public and does not require authentication
61
    #FIXME: Implement a Mojolicious login route
62
    #$r->get('/login')->to( controller => 'login', action => 'index' );
63
64
    #NOTE: All other routes require authentication
65
    my $auth = $r->under(
66
        '/' => sub {
67
            my $c = shift;
68
            if ( $c->koha->authenticate ) {
69
                return 1;
70
            } else {
71
72
                #FIXME: In future, redirect to a /login route, or prompt for login here
73
                $c->redirect_to('/index.html');
74
                return;
75
            }
76
        }
77
    );
78
    my $plugins = $auth->under('plugins');
79
    $plugins->any( [ 'GET', 'POST' ] => '/run' )->to( controller => 'Plugins', action => 'run' );
80
81
    #NOTE: Catch-all route to redirect to CGI 404 handler for any unmatched routes
82
    $auth->any(
83
        '/*' => sub {
84
            my $c = shift;
85
            $c->koha->render_staff_error( { status => 404 } );
86
        }
87
    );
88
}
89
90
1;
(-)a/Koha/Mojo/Staff/Controller/Plugins.pm (+54 lines)
Line 0 Link Here
1
package Koha::Mojo::Staff::Controller::Plugins;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Mojo::Base 'Mojolicious::Controller';
19
20
use C4::Context;
21
use Koha::Plugins::Handler;
22
23
=head1 NAME
24
25
Koha::Mojo::Staff::Controller::Plugins - Mojolicious controller for running Koha plugins
26
27
=head1 SYNOPSIS
28
29
=head2 METHODS
30
31
=head3 run
32
33
=cut
34
35
sub run {
36
    my $c      = shift;
37
    my $class  = $c->param('class');
38
    my $method = $c->param('method');
39
    my ( $flags, $loggedinuser ) = $c->koha->authorize( { flagsrequired => { 'plugins' => $method } } );
40
    my $plugins_enabled = C4::Context->config("enable_plugins");
41
    if ($plugins_enabled) {
42
        my $plugin = Koha::Plugins::Handler->run( { class => $class, method => $method, cgi => $c } );
43
    } else {
44
        my $template = $c->koha->template(
45
            {
46
                template_filename => 'plugins/plugins-disabled.tt',
47
                interface         => 'intranet',
48
            }
49
        );
50
        $c->render( text => $template->output );
51
    }
52
}
53
54
1;
(-)a/Koha/Template.pm (+65 lines)
Line 0 Link Here
1
package Koha::Template;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use C4::Templates;
21
22
=head1 NAME
23
24
Koha::Template - Koha class for preparing a template for any Koha web view
25
26
=head1 SYNOPSIS
27
28
=head2 METHODS
29
30
=head3 prepare_template
31
32
=cut
33
34
sub prepare_template {
35
    my ($args) = @_;
36
    my $template;
37
    my $session           = $args->{koha_session};
38
    my $user              = $args->{koha_user};
39
    my $authz             = $args->{koha_authz};
40
    my $template_filename = $args->{template_filename};
41
    my $interface         = $args->{interface};
42
    if ( $template_filename && $interface ) {
43
        $template = C4::Templates::gettemplate( $template_filename, $interface );
44
        if ($template) {
45
            if ($session) {
46
                $template->{VARS}->{sessionID} = $session->id;
47
            }
48
            if ($user) {
49
                $template->{VARS}->{logged_in_user}     = $user;
50
                $template->{VARS}->{loggedinusernumber} = $user->borrowernumber;
51
                $template->{VARS}->{loggedinusername}   = $user->userid;
52
            }
53
            if ($authz) {
54
                foreach my $key ( keys %$authz ) {
55
                    $template->{VARS}->{$key} = $authz->{$key};
56
                }
57
            }
58
59
            #NOTE: Instead of including syspref code here like in C4::Auth, start switching to Koha.Preference in templates
60
        }
61
    }
62
    return $template;
63
}
64
65
1;
(-)a/debian/templates/plack.psgi (+32 lines)
Lines 66-71 my $apiv1 = builder { Link Here
66
    $server->to_psgi_app;
66
    $server->to_psgi_app;
67
};
67
};
68
68
69
my $staff_interface = builder {
70
    my $server = Mojo::Server::PSGI->new;
71
    $server->build_app('Koha::Mojo::Staff');
72
    my $app = $server->app;
73
    $app->hook( before_dispatch => sub {
74
        my $c = shift;
75
        #NOTE: Rewrite the base path to strip off the mount prefix
76
        my $path = $c->req->url->base->path(Mojo::Path->new);
77
78
    });
79
    $server->to_psgi_app;
80
};
81
69
Koha::Logger->_init;
82
Koha::Logger->_init;
70
83
71
builder {
84
builder {
Lines 114-119 builder { Link Here
114
        }
127
        }
115
        $intranet;
128
        $intranet;
116
    };
129
    };
130
    mount '/intranet/staff' => builder {
131
        #NOTE: it is important that these are relative links
132
        enable 'ErrorDocument',
133
            400 => 'errors/400.pl',
134
            401 => 'errors/401.pl',
135
            402 => 'errors/402.pl',
136
            403 => 'errors/403.pl',
137
            404 => 'errors/404.pl',
138
            500 => 'errors/500.pl',
139
            subrequest => 1;
140
        #NOTE: Without this middleware to catch fatal errors, ErrorDocument won't be able to render a 500 document
141
        #NOTE: This middleware must be closer to the PSGI app than ErrorDocument
142
        enable "HTTPExceptions";
143
        if ( Log::Log4perl->get_logger('plack-intranet')->has_appenders ){
144
            enable 'Log4perl', category => 'plack-intranet';
145
            enable 'LogWarn';
146
        }
147
        $staff_interface;
148
    };
117
    mount '/api/v1/app.pl' => builder {
149
    mount '/api/v1/app.pl' => builder {
118
        if ( Log::Log4perl->get_logger('plack-api')->has_appenders ){
150
        if ( Log::Log4perl->get_logger('plack-api')->has_appenders ){
119
            enable 'Log4perl', category => 'plack-api';
151
            enable 'Log4perl', category => 'plack-api';
(-)a/staff (+21 lines)
Line 0 Link Here
1
#!/usr/bin/perl
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
require Mojolicious::Commands;
21
Mojolicious::Commands->start_app('Koha::Mojo::Staff');
(-)a/t/db_dependent/Koha/Auth.t (+163 lines)
Line 0 Link Here
1
#!/usr/bin/perl
2
3
use Modern::Perl;
4
use C4::Auth qw( get_session );
5
use Test::More tests => 8;
6
use t::lib::TestBuilder;
7
use t::lib::Mocks;
8
9
use Data::Dumper;
10
use Koha::Database;
11
12
use_ok('Koha::Auth');
13
14
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
15
16
my $schema = Koha::Database->new->schema;
17
$schema->storage->txn_begin;
18
19
subtest 'Successful authentication' => sub {
20
    plan tests => 2;
21
22
    $ENV{REMOTE_ADDR} = '127.0.0.1';
23
    my $builder  = t::lib::TestBuilder->new;
24
    my $borrower = $builder->build( { source => 'Borrower' } );
25
    my $session  = C4::Auth::get_session;
26
    $session->param( 'id',       $borrower->{userid} );
27
    $session->param( 'lasttime', time() );
28
    $session->param( 'ip',       '127.0.0.1' );
29
    $session->flush;
30
    my $sessionID = $session->id;
31
32
    my ( $user, $user_session ) = Koha::Auth->authenticate(
33
        {
34
            sessionID => $sessionID,
35
        }
36
    );
37
    is( ref $user,         'Koha::Patron', 'User found' );
38
    is( ref $user_session, 'CGI::Session', 'User session found' );
39
40
    $session->delete;
41
};
42
43
subtest 'Failed authentication' => sub {
44
    plan tests => 2;
45
46
    $ENV{REMOTE_ADDR} = '127.0.0.1';
47
    my $session = C4::Auth::get_session;
48
    $session->flush;
49
    $session->param( 'ip', '127.0.0.1' );
50
    my $sessionID = $session->id;
51
52
    my ( $user, $user_session ) = Koha::Auth->authenticate(
53
        {
54
            sessionID => $sessionID,
55
        }
56
    );
57
    is( $user,         undef, 'User not found' );
58
    is( $user_session, undef, 'User session not found' );
59
60
    $session->delete;
61
};
62
63
subtest 'Superlibrarian authorization' => sub {
64
    plan tests => 1;
65
    my $builder  = t::lib::TestBuilder->new;
66
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => 1, } } );
67
68
    my $session = C4::Auth::get_session;
69
    $session->param( 'id',       $borrower->{userid} );
70
    $session->param( 'lasttime', time() );
71
    $session->param( 'ip',       '127.0.0.1' );
72
    $session->flush;
73
74
    my $flags = Koha::Auth->authorize(
75
        {
76
            session       => $session,
77
            flagsrequired => { circulate => 1 },
78
        }
79
    );
80
    is( $flags->{superlibrarian}, 1, 'Got superlibrarian authorization' );
81
};
82
83
subtest 'Circulation staff authorization' => sub {
84
    plan tests => 2;
85
    my $builder  = t::lib::TestBuilder->new;
86
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => 2, } } );
87
88
    my $session = C4::Auth::get_session;
89
    $session->param( 'id',       $borrower->{userid} );
90
    $session->param( 'lasttime', time() );
91
    $session->param( 'ip',       '127.0.0.1' );
92
    $session->flush;
93
94
    my $flags = Koha::Auth->authorize(
95
        {
96
            session       => $session,
97
            flagsrequired => { circulate => 1 },
98
        }
99
    );
100
    is( $flags->{superlibrarian}, 0, 'Did not get superlibrarian authorization' );
101
    is( $flags->{circulate},      1, 'Did get circulate authorization' );
102
};
103
104
subtest 'Public user not authorized for circulate authorization requirement' => sub {
105
    plan tests => 1;
106
    my $builder  = t::lib::TestBuilder->new;
107
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => undef, } } );
108
109
    my $session = C4::Auth::get_session;
110
    $session->param( 'id',       $borrower->{userid} );
111
    $session->param( 'lasttime', time() );
112
    $session->param( 'ip',       '127.0.0.1' );
113
    $session->flush;
114
115
    my $flags = Koha::Auth->authorize(
116
        {
117
            session       => $session,
118
            flagsrequired => { circulate => 1 },
119
        }
120
    );
121
    is( $flags, 0, 'Flags returned 0' );
122
};
123
124
subtest 'Staff user not authorized for circulate authorization requirement' => sub {
125
    plan tests => 1;
126
    my $builder  = t::lib::TestBuilder->new;
127
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => 4, } } );
128
129
    my $session = C4::Auth::get_session;
130
    $session->param( 'id',       $borrower->{userid} );
131
    $session->param( 'lasttime', time() );
132
    $session->param( 'ip',       '127.0.0.1' );
133
    $session->flush;
134
135
    my $flags = Koha::Auth->authorize(
136
        {
137
            session       => $session,
138
            flagsrequired => { circulate => 1 },
139
        }
140
    );
141
    is( $flags, 0, 'Flags returned 0' );
142
};
143
144
subtest 'No authorization required' => sub {
145
    plan tests => 1;
146
    my $builder  = t::lib::TestBuilder->new;
147
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => undef, } } );
148
149
    my $session = C4::Auth::get_session;
150
    $session->param( 'id',       $borrower->{userid} );
151
    $session->param( 'lasttime', time() );
152
    $session->param( 'ip',       '127.0.0.1' );
153
    $session->flush;
154
155
    my $flags = Koha::Auth->authorize(
156
        {
157
            session => $session,
158
        }
159
    );
160
    is( ref $flags, 'HASH', 'When no flags are required, a hashref is returned' );
161
};
162
163
$schema->storage->txn_rollback;
(-)a/t/db_dependent/Koha/Mojo/Plugins/Core.t (+119 lines)
Line 0 Link Here
1
#!/usr/bin/perl
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
# Dummy app for testing the plugin
21
use Mojolicious::Lite;
22
use Try::Tiny;
23
24
use C4::Auth qw//;
25
use Koha::Patrons;
26
use t::lib::TestBuilder;
27
use t::lib::Mocks;
28
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
29
30
my $schema = Koha::Database->new->schema;
31
32
app->log->level('error');
33
34
plugin 'Koha::Mojo::Plugins::Core';
35
36
get '/get_helper_details' => sub {
37
    my $c = shift;
38
    try {
39
        my $authenticated = $c->koha->authenticate();
40
        my ( $flags, $loggedinuser ) = $c->koha->authorize();
41
        my $template = $c->koha->template(
42
            {
43
                template_filename => 'about.tt',
44
                interface         => 'intranet',
45
            }
46
        );
47
        $c->render(
48
            json => {
49
                authenticated  => $authenticated,
50
                flags          => $flags,
51
                borrowernumber => $loggedinuser->borrowernumber,
52
                template       => {
53
                    output             => $template->output,
54
                    sessionID          => $template->{VARS}->{sessionID},
55
                    loggedinusernumber => $template->{VARS}->{loggedinusernumber},
56
                    loggedinusername   => $template->{VARS}->{loggedinusername},
57
                    CAN_user_circulate => $template->{VARS}->{CAN_user_circulate},
58
                },
59
            },
60
            status => 200,
61
        );
62
    } catch {
63
        my $status = 500;
64
        if ( $_->isa('Koha::Exceptions::Authorization::Unauthorized') ) {
65
            $status = 403;
66
        }
67
        $c->render( status => $status, text => '' );
68
    };
69
};
70
71
sub to_model {
72
    my ($args) = @_;
73
    return $args;
74
}
75
76
# The tests
77
78
use Test::More tests => 2;
79
use Test::Mojo;
80
81
subtest 'Test core plugins with no session' => sub {
82
83
    plan tests => 2;
84
85
    my $t = Test::Mojo->new;
86
    $t->get_ok('/get_helper_details')->status_is(403);
87
};
88
89
subtest 'Test core plugins with superlibrarian' => sub {
90
    plan tests => 10;
91
    $schema->storage->txn_begin;
92
93
    my $builder  = t::lib::TestBuilder->new;
94
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => 1, } } );
95
    my $patron   = Koha::Patrons->find( $borrower->{borrowernumber} );
96
97
    my $remote_address = '127.0.0.1';
98
    $ENV{REMOTE_ADDR} = $remote_address;
99
    my $session = C4::Auth::get_session;
100
    $session->param( 'id',       $borrower->{userid} );
101
    $session->param( 'lasttime', time() );
102
    $session->param( 'ip',       $remote_address );
103
    $session->flush;
104
105
    my $t  = Test::Mojo->new;
106
    my $tx = $t->ua->build_tx( GET => '/get_helper_details' );
107
    $tx->req->cookies( { name => 'CGISESSID', value => $session->id } );
108
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
109
    $t->request_ok($tx)->status_is(200)->json_is( '/authenticated' => 1, 'authenticated' )
110
        ->json_is( '/flags/superlibrarian' => 1,                       'superlibrarian flag set' )
111
        ->json_is( '/borrowernumber'       => $patron->borrowernumber, 'Borrower found' )
112
        ->json_has( '/template/output', 'template output set' )
113
        ->json_is( '/template/sessionID'          => $session->id,            'sesssionID set' )
114
        ->json_is( '/template/loggedinusernumber' => $patron->borrowernumber, 'loggedinusernumber set' )
115
        ->json_is( '/template/loggedinusername'   => $patron->userid,         'loggedinusername set' )
116
        ->json_is( '/template/CAN_user_circulate' => 1,                       'template permissions set' );
117
118
    $schema->storage->txn_rollback;
119
};
(-)a/t/db_dependent/Koha/Template.t (-1 / +65 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/perl
2
3
use Modern::Perl;
4
use C4::Auth qw( get_session );
5
use Test::More tests => 2;
6
use t::lib::TestBuilder;
7
use t::lib::Mocks;
8
9
use Koha::Database;
10
use Data::Dumper;
11
use Koha::Auth;
12
use Koha::Auth::Permissions;
13
use Koha::Patrons;
14
use_ok('Koha::Template');
15
16
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
17
18
my $schema = Koha::Database->new->schema;
19
$schema->storage->txn_begin;
20
21
subtest 'Prepare template' => sub {
22
    plan tests => 6;
23
24
    $ENV{REMOTE_ADDR} = '127.0.0.1';
25
    my $builder  = t::lib::TestBuilder->new;
26
    my $borrower = $builder->build( { source => 'Borrower', value => { flags => 2, } } );
27
    my $session  = C4::Auth::get_session;
28
    $session->param( 'id',       $borrower->{userid} );
29
    $session->param( 'lasttime', time() );
30
    $session->param( 'ip',       '127.0.0.1' );
31
    $session->flush;
32
    my $sessionID = $session->id;
33
    my $flags     = Koha::Auth->authorize(
34
        {
35
            session       => $session,
36
            flagsrequired => { circulate => 1 },
37
        }
38
    );
39
    my $koha_authz = Koha::Auth::Permissions->get_authz_from_flags( { flags => $flags } );
40
    my $koha_user  = Koha::Patrons->find( $borrower->{borrowernumber} );
41
42
    my $htdocs            = C4::Context->config('intrahtdocs');
43
    my $template_filename = $htdocs . '/prog/en/modules/about.tt';
44
    my $interface         = "intranet";
45
    my $template          = Koha::Template::prepare_template(
46
        {
47
            template_filename => $template_filename,
48
            interface         => $interface,
49
            koha_session      => $session,
50
            koha_user         => $koha_user,
51
            koha_authz        => $koha_authz,
52
        }
53
    );
54
55
    ok( $template->output, 'Template generates output' );
56
    is( $template->{VARS}->{sessionID},          $session->id,               'sessionID set' );
57
    is( $template->{VARS}->{logged_in_user},     $koha_user,                 'logged_in_user set' );
58
    is( $template->{VARS}->{loggedinusernumber}, $koha_user->borrowernumber, 'loggedinusernumber set' );
59
    is( $template->{VARS}->{loggedinusername},   $koha_user->userid,         'loggedinusername set' );
60
    is( $template->{VARS}->{CAN_user_circulate}, 1,                          'CAN_user_circulate set' );
61
62
    $session->delete;
63
};
64
65
$schema->storage->txn_rollback;

Return to bug 31380