From 14c57d90b73d11b1edc55e0ab1c071d28a4e2098 Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Thu, 30 May 2024 06:55:32 -0400 Subject: [PATCH] Bug 36988: Update unit tests These highlight why we may have made this choice. With only 'edit_borrowers' you can make changes, but you cannot view your changes as you aren't allowed to see other borrowers. Test now pass, but not sure if this answers the question of why we did it this way, or if there is more work here. Should you be able to get back the fields that you updated at the least, to confirm your changes? Or should we send a success with a message that you can't see the data? --- t/db_dependent/api/v1/patrons.t | 38 +++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 11 deletions(-) diff --git a/t/db_dependent/api/v1/patrons.t b/t/db_dependent/api/v1/patrons.t index aff93e092b0..0ba80e965d3 100755 --- a/t/db_dependent/api/v1/patrons.t +++ b/t/db_dependent/api/v1/patrons.t @@ -850,9 +850,29 @@ subtest 'update() tests' => sub { my $authorized_patron = $builder->build_object( { class => 'Koha::Patrons', - value => { flags => 1 } + value => { flags => 2**2 } # catalog only, no additional permissions + } + ); + + my $superlibrarian = $builder->build_object( + { + class => 'Koha::Patrons', + value => { flags => 1 } # superlibrarian + } + ); + + # Ensure our librarian can see users from all branches (once list_borrowers is added) + $builder->build( + { + source => 'UserPermission', + value => { + borrowernumber => $authorized_patron->borrowernumber, + module_bit => 4, + code => 'edit_borrowers', + }, } ); + my $password = 'thePassword123'; $authorized_patron->set_password( { password => $password, skip_validation => 1 } ); my $userid = $authorized_patron->userid; @@ -868,7 +888,10 @@ subtest 'update() tests' => sub { my $patron_1 = $authorized_patron; my $patron_2 = $unauthorized_patron; - my $newpatron = $unauthorized_patron->to_api( { user => $authorized_patron } ); + my $newpatron = $unauthorized_patron->to_api( { user => $superlibrarian } ) + ; # Need to use a patron with ability to view the patron + my $blanked_patron = $unauthorized_patron->to_api( { user => $authorized_patron } ) + ; # The api return will blank since we can't see, only update # delete RO attributes delete $newpatron->{patron_id}; @@ -953,8 +976,8 @@ subtest 'update() tests' => sub { my $got = $result->tx->res->json; my $updated_on_got = delete $got->{updated_on}; - my $updated_on_expected = delete $newpatron->{updated_on}; - is_deeply( $got, $newpatron, 'Returned patron from update matches expected' ); + my $updated_on_expected = delete $blanked_patron->{updated_on}; + is_deeply( $got, $blanked_patron, 'Returned patron from update matches expected' ); is( t::lib::Dates::compare( dt_from_string( $updated_on_got, 'rfc3339' ), @@ -969,13 +992,6 @@ subtest 'update() tests' => sub { $newpatron->{cardnumber}, 'Patron is really updated!' ); - my $superlibrarian = $builder->build_object( - { - class => 'Koha::Patrons', - value => { flags => 1 } - } - ); - $newpatron->{cardnumber} = $superlibrarian->cardnumber; $newpatron->{userid} = $superlibrarian->userid; $newpatron->{email} = 'nosense@no.no'; -- 2.39.5