Lines 180-186
subtest "Test endpoints without permission" => sub {
Link Here
|
180 |
->status_is(403); |
180 |
->status_is(403); |
181 |
}; |
181 |
}; |
182 |
subtest "Test endpoints without permission, but accessing own object" => sub { |
182 |
subtest "Test endpoints without permission, but accessing own object" => sub { |
183 |
plan tests => 15; |
183 |
plan tests => 21; |
|
|
184 |
|
185 |
my $reserve_id3 = C4::Reserves::AddReserve($branchcode, $nopermission->{'borrowernumber'}, |
186 |
$biblionumber, undef, 2, undef, undef, undef, '', $itemnumber, 'W'); |
187 |
# try to delete my own hold while it's waiting; an error should occur |
188 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id3" => json => $put_data); |
189 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
190 |
$t->request_ok($tx) |
191 |
->status_is(403) |
192 |
->json_is('/error', 'Hold is already in transfer or waiting and cannot be cancelled by patron.'); |
193 |
# reset the hold's found status; after that, cancellation should work |
194 |
Koha::Holds->find($reserve_id3)->found('')->store; |
195 |
$tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id3" => json => $put_data); |
196 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
197 |
$t->request_ok($tx) |
198 |
->status_is(200); |
199 |
is(Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} }), undef, "Hold deleted."); |
184 |
|
200 |
|
185 |
my $borrno_tmp = $post_data->{'borrowernumber'}; |
201 |
my $borrno_tmp = $post_data->{'borrowernumber'}; |
186 |
$post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'}; |
202 |
$post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'}; |
Lines 201-207
subtest "Test endpoints without permission, but accessing own object" => sub {
Link Here
|
201 |
->json_is('/0/expirationdate', $expirationdate) |
217 |
->json_is('/0/expirationdate', $expirationdate) |
202 |
->json_is('/0/branchcode', $branchcode); |
218 |
->json_is('/0/branchcode', $branchcode); |
203 |
|
219 |
|
204 |
my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id; |
220 |
$reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id; |
205 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data); |
221 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data); |
206 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
222 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
207 |
$t->request_ok($tx) # create hold to myself |
223 |
$t->request_ok($tx) # create hold to myself |
208 |
- |
|
|