From a4f0634cd78520202b12ed01bb3b1b812e8b3c2c Mon Sep 17 00:00:00 2001
From: Lari Taskula <larit@student.uef.fi>
Date: Mon, 22 Aug 2016 17:35:44 +0300
Subject: [PATCH] Bug 17003: Add API route to get checkout's renewability

GET /checkouts/{checkout_id}/renewability (renewability status)

Response:
- 200: renewable (empty response object {})
- 403: not renewable (or not authorized to make renewals)

To test:
1. Login to Koha
2. Checkout something for yourself
3. Make GET request to http://yourlibrary/api/v1/checkouts/YYY/renewability
   where YYY is checkout_id of your checkout.
4. Observe returned data and HTTP code (200 for renewable, 403 for not renewable)
   If not renewable, an error should also be presented.
5. Run t/db_dependent/api/v1/checkouts.t
---
 Koha/REST/V1/Checkout.pm          | 35 +++++++++++++++++++++++++++++++++++
 api/v1/swagger.json               | 32 ++++++++++++++++++++++++++++++++
 t/db_dependent/api/v1/checkouts.t | 20 +++++++++++++++++++-
 3 files changed, 86 insertions(+), 1 deletion(-)

diff --git a/Koha/REST/V1/Checkout.pm b/Koha/REST/V1/Checkout.pm
index fb197dd..234c93c 100644
--- a/Koha/REST/V1/Checkout.pm
+++ b/Koha/REST/V1/Checkout.pm
@@ -18,6 +18,7 @@ package Koha::REST::V1::Checkout;
 use Modern::Perl;
 
 use Mojo::Base 'Mojolicious::Controller';
+use Mojo::JSON;
 
 use C4::Auth qw( haspermission );
 use C4::Context;
@@ -105,4 +106,38 @@ sub renew {
     return $c->$cb($checkout->unblessed, 200);
 }
 
+sub renewability {
+    my ($c, $args, $cb) = @_;
+
+    my $user = $c->stash('koha.user');
+
+    my $checkout_id = $args->{checkout_id};
+    my $checkout = Koha::Issues->find($checkout_id);
+
+    if (!$checkout) {
+        return $c->$cb({
+            error => "Checkout doesn't exist"
+        }, 404);
+    }
+
+    my $borrowernumber = $checkout->borrowernumber;
+    my $itemnumber = $checkout->itemnumber;
+
+    my $OpacRenewalAllowed;
+    if ($user->borrowernumber == $borrowernumber) {
+        $OpacRenewalAllowed = C4::Context->preference('OpacRenewalAllowed');
+    }
+
+    unless ($user && ($OpacRenewalAllowed
+            || haspermission($user->userid, { circulate => "circulate_remaining_permissions" }))) {
+        return $c->$cb({error => "You don't have the required permission"}, 403);
+    }
+
+    my ($can_renew, $error) = C4::Circulation::CanBookBeRenewed(
+        $borrowernumber, $itemnumber);
+
+    return $c->$cb({}, 200) if $can_renew;
+    return $c->$cb({error => "Renewal not authorized ($error)"}, 403);
+}
+
 1;
diff --git a/api/v1/swagger.json b/api/v1/swagger.json
index ad11c17..4991506 100644
--- a/api/v1/swagger.json
+++ b/api/v1/swagger.json
@@ -426,6 +426,38 @@
           }
         }
       }
+    },
+    "/checkouts/{checkout_id}/renewability": {
+      "get": {
+        "operationId": "renewabilityCheckout",
+        "tags": ["patrons", "checkouts"],
+        "parameters": [
+          {
+            "name": "checkout_id",
+            "in": "path",
+            "description": "Internal checkout identifier",
+            "required": true,
+            "type": "integer"
+          }
+        ],
+        "produces": ["application/json"],
+        "responses": {
+          "200": {
+            "description": "Checkout is renewable",
+            "schema": {
+                "type": "object"
+            }
+          },
+          "403": {
+            "description": "Checkout is not renewable",
+            "schema": { "$ref": "#/definitions/error" }
+          },
+          "404": {
+            "description": "Checkout not found",
+            "schema": { "$ref": "#/definitions/error" }
+          }
+        }
+      }
     }
   },
   "definitions": {
diff --git a/t/db_dependent/api/v1/checkouts.t b/t/db_dependent/api/v1/checkouts.t
index 4db5a8f..c1b453c 100644
--- a/t/db_dependent/api/v1/checkouts.t
+++ b/t/db_dependent/api/v1/checkouts.t
@@ -17,7 +17,7 @@
 
 use Modern::Perl;
 
-use Test::More tests => 57;
+use Test::More tests => 66;
 use Test::MockModule;
 use Test::Mojo;
 use t::lib::Mocks;
@@ -183,7 +183,19 @@ $t->request_ok($tx)
   ->status_is(403)
   ->json_is({ error => "You don't have the required permission" });
 
+$tx = $t->ua->build_tx(GET => "/api/v1/checkouts/" . $issue2->issue_id . "/renewability");
+$tx->req->cookies({name => 'CGISESSID', value => $borrower_session->id});
+$t->request_ok($tx)
+  ->status_is(403)
+  ->json_is({ error => "You don't have the required permission" });
+  
 t::lib::Mocks::mock_preference( "OpacRenewalAllowed", 1 );
+$tx = $t->ua->build_tx(GET => "/api/v1/checkouts/" . $issue2->issue_id . "/renewability");
+$tx->req->cookies({name => 'CGISESSID', value => $borrower_session->id});
+$t->request_ok($tx)
+  ->status_is(200)
+  ->json_is({});
+
 $tx = $t->ua->build_tx(PUT => "/api/v1/checkouts/" . $issue2->issue_id);
 $tx->req->cookies({name => 'CGISESSID', value => $borrower_session->id});
 $t->request_ok($tx)
@@ -196,6 +208,12 @@ $t->request_ok($tx)
   ->status_is(403)
   ->json_is({ error => 'Renewal not authorized (too_many)' });
 
+$tx = $t->ua->build_tx(GET => "/api/v1/checkouts/" . $issue2->issue_id . "/renewability");
+$tx->req->cookies({name => 'CGISESSID', value => $borrower_session->id});
+$t->request_ok($tx)
+  ->status_is(403)
+  ->json_is({ error => 'Renewal not authorized (too_many)' });
+
 sub create_biblio {
     my ($title) = @_;
 
-- 
1.9.1