From 63ec967c6568e5dde3f4e6b6cdb479dd359ea655 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Wed, 5 Jun 2024 15:58:06 +0100
Subject: [PATCH] Bug 37018: Throw exception and render error

For some reason this doesn't work :(. We still result in a 200, when I'd
expect a 400 instead coming from the catch block.  It would be nice to
use openapi too for the 400 render but I can't use that in the way the
test is written.
---
 Koha/REST/Plugin/Query.pm | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/Koha/REST/Plugin/Query.pm b/Koha/REST/Plugin/Query.pm
index 39fbe62b4a9..a4160ac7d2e 100644
--- a/Koha/REST/Plugin/Query.pm
+++ b/Koha/REST/Plugin/Query.pm
@@ -21,6 +21,7 @@ use Mojo::Base 'Mojolicious::Plugin';
 use List::MoreUtils qw( any );
 use Scalar::Util qw( reftype );
 use JSON qw( decode_json );
+use Try::Tiny qw( catch try );
 
 use Koha::Exceptions;
 
@@ -198,7 +199,16 @@ Validate operators in the passed query.
     $app->helper(
         'dbic_validate_operators' => sub {
             my ( $c, $args ) = @_;
-            _validate_query($args->{filtered_params});
+            return try {
+                _validate_query( $args->{filtered_params} );
+            } catch {
+                if ( blessed $_ && $_->isa('Koha::Exceptions::BadParameter') ) {
+                    return $c->render(
+                        status  => 400,
+                        json => { error => $_->error }
+                    );
+                }
+            };
         }
     );
 
@@ -663,7 +673,8 @@ sub _rewrite_related_metadata_query {
 sub _validate_operator {
     my ($operator) = @_;
     my %allowed_operators = map { $_ => 1 } qw(= != < > <= >= like -not_like -in -ident -bool -not_bool -or);
-    die "Invalid operator: $operator" unless exists $allowed_operators{$operator};
+    Koha::Exceptions::BadParameter->throw(
+                "Invalid operator in query: $operator") unless exists $allowed_operators{$operator};
     return;
 }
 
-- 
2.45.2