From 2922626bc6f938b84b98a40d2975e9670ec74e34 Mon Sep 17 00:00:00 2001 From: Tomas Cohen Arazi Date: Wed, 23 Apr 2025 12:09:36 -0300 Subject: [PATCH] Bug 38340: Rewrite controllers This patch splits the controller in two: * A controller for staff users use * An unprivileged access controller The public one makes use of the state-of-the-art in Koha for public endpoints, using the `$c->auth->public` validation helper and leaving the (newly added) public path spec with no special permissions requirements. The staff-oriented endpoint gets the right permissions added (at least those used in the main `/ill/requests` endpoint. TODO: Tests need to be split for both controllers, and adjusted. TODO: The OPAC changes need to be redone using the public endpoint. TODO: The OPAC table should use kohaTable. Signed-off-by: Tomas Cohen Arazi --- Koha/REST/V1/ILL/Requests.pm | 44 ++++++++++----- api/v1/swagger/paths/patrons.yaml | 4 +- api/v1/swagger/paths/public_patrons.yaml | 68 +++++++++++++++++++++++- 3 files changed, 99 insertions(+), 17 deletions(-) diff --git a/Koha/REST/V1/ILL/Requests.pm b/Koha/REST/V1/ILL/Requests.pm index bb8eecb15e1..3f4652790ae 100644 --- a/Koha/REST/V1/ILL/Requests.pm +++ b/Koha/REST/V1/ILL/Requests.pm @@ -60,32 +60,48 @@ sub list { =head3 patron_list -Controller function that handles listing Koha::ILL::Request objects for a given patron. - -The patron must match the requesting user unless the requesting user is a superlibrarian. - -This is a public route, so some request details are omitted. +Controller function that returns a patron's list of ILL requests. =cut sub patron_list { - my $c = shift->openapi->valid_input or return; - my $user = $c->stash('koha.user'); - $c->stash( is_public => 1 ); + my $c = shift->openapi->valid_input or return; + + my $patron = Koha::Patrons->find( $c->param('patron_id') ); + + return $c->render_resource_not_found('Patron') + unless $patron; + + return try { - if ( $user->borrowernumber != $c->param('patron_id') and !$user->is_superlibrarian ) { return $c->render( - status => 403, - openapi => { error => "Cannot lookup ILL requests for other users" } + status => 200, + openapi => $c->objects->search( $patron->ill_requests ), ); - } + } catch { + $c->unhandled_exception($_); + }; +} + +=head3 public_patron_list + +Controller function that returns a patron's list of ILL requests for unprivileged +access. + +=cut + +sub public_patron_list { + my $c = shift->openapi->valid_input or return; return try { - my $reqs = $c->objects->search( Koha::ILL::Requests->search( { borrowernumber => $c->param('patron_id') } ) ); + + $c->auth->public( $c->param('patron_id') ); + + my $patron = $c->stash('koha.user'); return $c->render( status => 200, - openapi => $reqs, + openapi => $c->objects->search( $patron->ill_requests() ), ); } catch { $c->unhandled_exception($_); diff --git a/api/v1/swagger/paths/patrons.yaml b/api/v1/swagger/paths/patrons.yaml index dca5ce64bed..65ac96a2ced 100644 --- a/api/v1/swagger/paths/patrons.yaml +++ b/api/v1/swagger/paths/patrons.yaml @@ -667,7 +667,6 @@ x-mojo-to: ILL::Requests#patron_list operationId: getPatronIllRequests tags: - - patrons - ill_requests summary: Get patron's ILL requests parameters: @@ -727,4 +726,5 @@ schema: $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: - permissions: {} + permissions: + ill: "1" diff --git a/api/v1/swagger/paths/public_patrons.yaml b/api/v1/swagger/paths/public_patrons.yaml index 7952eabfaad..f0cd226117a 100644 --- a/api/v1/swagger/paths/public_patrons.yaml +++ b/api/v1/swagger/paths/public_patrons.yaml @@ -277,4 +277,70 @@ "503": description: Under maintenance schema: - $ref: "../swagger.yaml#/definitions/error" \ No newline at end of file + $ref: "../swagger.yaml#/definitions/error" +"/public/patrons/{patron_id}/ill/requests": + get: + x-mojo-to: ILL::Requests#public_patron_list + operationId: getPatronIllRequests + tags: + - ill_requests + summary: Get patron's ILL requests + parameters: + - $ref: "../swagger.yaml#/parameters/patron_id_pp" + - $ref: "../swagger.yaml#/parameters/page" + - $ref: "../swagger.yaml#/parameters/per_page" + - $ref: "../swagger.yaml#/parameters/match" + - $ref: "../swagger.yaml#/parameters/order_by" + - $ref: "../swagger.yaml#/parameters/q_param" + - $ref: "../swagger.yaml#/parameters/q_body" + - $ref: "../swagger.yaml#/parameters/request_id_header" + - name: x-koha-embed + in: header + required: false + description: Embed list sent as a request header + type: array + items: + type: string + enum: + - +strings + - extended_attributes + collectionFormat: csv + produces: + - application/json + responses: + "200": + description: A list of parton's ILL requests + schema: + type: array + items: + $ref: "../swagger.yaml#/definitions/ill_request" + "400": + description: Bad request + schema: + $ref: "../swagger.yaml#/definitions/error" + "401": + description: Authentication required + schema: + $ref: "../swagger.yaml#/definitions/error" + "403": + description: Access forbidden + schema: + $ref: "../swagger.yaml#/definitions/error" + "404": + description: Patron not found + schema: + $ref: "../swagger.yaml#/definitions/error" + "500": + description: | + Internal server error. Possible `error_code` attribute values: + + * `internal_server_error` + schema: + $ref: "../swagger.yaml#/definitions/error" + "503": + description: Under maintenance + schema: + $ref: "../swagger.yaml#/definitions/error" + x-koha-authorization: + permissions: + ill: "1" -- 2.49.0