View | Details | Raw Unified | Return to bug 17479
Collapse All | Expand All

(-)a/Koha/REST/V1.pm (-2 / +7 lines)
Lines 110-122 sub authenticate_api_request { Link Here
110
    my $permissions = $authorization->{'permissions'};
110
    my $permissions = $authorization->{'permissions'};
111
111
112
    # Check if the user is authorized
112
    # Check if the user is authorized
113
    my ($owner_access, $guarantor_access);
113
    if ( C4::Auth::haspermission($user->userid, $permissions)
114
    if ( C4::Auth::haspermission($user->userid, $permissions)
114
        or allow_owner($c, $authorization, $user)
115
        or $owner_access = allow_owner($c, $authorization, $user)
115
        or allow_guarantor($c, $authorization, $user) ) {
116
        or $guarantor_access = allow_guarantor($c, $authorization, $user) ) {
116
117
117
        # Return the query errors if exist
118
        # Return the query errors if exist
118
        return $c->render_swagger({}, \@query_errors, 400) if @query_errors;
119
        return $c->render_swagger({}, \@query_errors, 400) if @query_errors;
119
120
121
        # Store information on owner/guarantor access
122
        $c->stash('is_owner_access', 1) if $owner_access;
123
        $c->stash('is_guarantor_access', 1) if $guarantor_access;
124
120
        # Everything is ok
125
        # Everything is ok
121
        return $next->($c)
126
        return $next->($c)
122
    }
127
    }
(-)a/t/db_dependent/api/v1/ownerflag.t (-1 / +117 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/env perl
2
3
# Copyright 2016 Koha-Suomi Oy
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 3 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along
17
# with Koha; if not, write to the Free Software Foundation, Inc.,
18
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19
20
use Modern::Perl;
21
22
use Test::More tests => 9;
23
use Test::Mojo;
24
use Test::MockModule;
25
use t::lib::TestBuilder;
26
27
use C4::Auth;
28
use C4::Context;
29
30
use Koha::Database;
31
use Koha::Patron;
32
33
my $mock = Test::MockModule->new('Koha::REST::V1::Patron');
34
$mock->mock(get => sub {
35
    my ($c, $args, $cb) = @_;
36
37
    # return 404 because it has a generic response schema that is unlikely to change
38
    return $c->$cb({ error => "is_owner_access" }, 404) if $c->stash('is_owner_access');
39
    return $c->$cb({ error => "is_guarantor_access" }, 404) if $c->stash('is_guarantor_access');
40
    return $c->$cb({ error => "librarian_access" }, 404);
41
});
42
my $builder = t::lib::TestBuilder->new();
43
44
my $dbh = C4::Context->dbh;
45
$dbh->{AutoCommit} = 0;
46
$dbh->{RaiseError} = 1;
47
48
$ENV{REMOTE_ADDR} = '127.0.0.1';
49
my $t = Test::Mojo->new('Koha::REST::V1');
50
51
my $categorycode = $builder->build({ source => 'Category' })->{ categorycode };
52
my $branchcode = $builder->build({ source => 'Branch' })->{ branchcode };
53
my $guarantor = $builder->build({
54
    source => 'Borrower',
55
    value => {
56
        branchcode   => $branchcode,
57
        categorycode => $categorycode,
58
        flags        => 0,
59
    }
60
});
61
my $borrower = $builder->build({
62
    source => 'Borrower',
63
    value => {
64
        branchcode   => $branchcode,
65
        categorycode => $categorycode,
66
        flags        => 0,
67
        guarantorid    => $guarantor->{borrowernumber},
68
    }
69
});
70
my $librarian = $builder->build({
71
    source => 'Borrower',
72
    value => {
73
        branchcode   => $branchcode,
74
        categorycode => $categorycode,
75
        flags        => 16,
76
    }
77
});
78
79
my $session = create_session($borrower);
80
my $session2 = create_session($guarantor);
81
my $lib_session = create_session($librarian);
82
83
# User without permissions, but is the owner of the object
84
my $tx = $t->ua->build_tx(GET => "/api/v1/patrons/" . $borrower->{borrowernumber});
85
$tx->req->cookies({name => 'CGISESSID', value => $session->id});
86
$t->request_ok($tx)
87
  ->status_is(404)
88
  ->json_is('/error', 'is_owner_access');
89
90
# User without permissions, but is the guarantor of the owner of the object
91
$tx = $t->ua->build_tx(GET => "/api/v1/patrons/" . $borrower->{borrowernumber});
92
$tx->req->cookies({name => 'CGISESSID', value => $session2->id});
93
$t->request_ok($tx)
94
  ->status_is(404)
95
  ->json_is('/error', 'is_guarantor_access');
96
97
# User with permissions
98
$tx = $t->ua->build_tx(GET => "/api/v1/patrons/" . $librarian->{borrowernumber});
99
$tx->req->cookies({name => 'CGISESSID', value => $lib_session->id});
100
$t->request_ok($tx)
101
  ->status_is(404)
102
  ->json_is('/error', 'librarian_access');
103
104
$dbh->rollback;
105
106
sub create_session {
107
    my ($patron) = @_;
108
109
    my $session = C4::Auth::get_session('');
110
    $session->param('number', $patron->{ borrowernumber });
111
    $session->param('id', $patron->{ userid });
112
    $session->param('ip', '127.0.0.1');
113
    $session->param('lasttime', time());
114
    $session->flush;
115
116
    return $session;
117
}

Return to bug 17479