View | Details | Raw Unified | Return to bug 18120
Collapse All | Expand All

(-)a/t/db_dependent/api/v1/acquisitions_vendors.t (-1 / +346 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/env perl
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it under the
6
# terms of the GNU General Public License as published by the Free Software
7
# Foundation; either version 3 of the License, or (at your option) any later
8
# version.
9
#
10
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
11
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
12
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
13
#
14
# You should have received a copy of the GNU General Public License along
15
# with Koha; if not, write to the Free Software Foundation, Inc.,
16
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
17
18
use Modern::Perl;
19
20
use Test::More tests => 5;
21
use Test::Mojo;
22
use Test::Warn;
23
24
use t::lib::TestBuilder;
25
use t::lib::Mocks;
26
27
use C4::Auth;
28
use Koha::Acquisition::Booksellers;
29
use Koha::Database;
30
31
my $schema  = Koha::Database->new->schema;
32
my $builder = t::lib::TestBuilder->new;
33
34
# FIXME: sessionStorage defaults to mysql, but it seems to break transaction handling
35
# this affects the other REST api tests
36
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
37
38
my $remote_address = '127.0.0.1';
39
my $t              = Test::Mojo->new('Koha::REST::V1');
40
41
subtest 'list() and delete() tests | authorized user' => sub {
42
43
    plan tests => 23;
44
45
    $schema->storage->txn_begin;
46
47
    Koha::Acquisition::Booksellers->search->delete;
48
    my ( $borrowernumber, $session_id )
49
        = create_user_and_session( { authorized => 1 } );
50
51
    ## Authorized user tests
52
    # No vendors, so empty array should be returned
53
    my $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors' );
54
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
55
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
56
    $t->request_ok($tx)->status_is(200)->json_is( [] );
57
58
    my $vendor_name = 'Ruben libros';
59
    my $vendor = $builder->build( { source => 'Aqbookseller', value => { name => $vendor_name } } );
60
61
    # One vendor created, should get returned
62
    $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors' );
63
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
64
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
65
    $t->request_ok($tx)->status_is(200)->json_like( '/0/name' => qr/$vendor_name/ );
66
67
    my $other_vendor_name = 'Amerindia';
68
    my $other_vendor
69
        = $builder->build( { source => 'Aqbookseller', value => { name => $other_vendor_name } } );
70
71
    $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors' );
72
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
73
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
74
    $t->request_ok($tx)->status_is(200)->json_like( '/0/name' => qr/Amerindia/ )
75
        ->json_like( '/1/name' => qr/Ruben/ );
76
77
    $tx = $t->ua->build_tx( DELETE => '/api/v1/acquisitions/vendors/' . $vendor->{id} );
78
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
79
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
80
    $t->request_ok($tx)->status_is(200)->content_is(q{});
81
82
    $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors' );
83
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
84
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
85
    $t->request_ok($tx)->status_is(200)->json_like( '/0/name' => qr/$other_vendor_name/ )
86
        ->json_hasnt( '/1', 'Only one vendor' );
87
88
    $tx = $t->ua->build_tx( DELETE => '/api/v1/acquisitions/vendors/' . $other_vendor->{id} );
89
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
90
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
91
    $t->request_ok($tx)->status_is(200)->content_is(q{});
92
93
    $tx = $t->ua->build_tx( GET => '/api/v1/acquisitions/vendors' );
94
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
95
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
96
    $t->request_ok($tx)->status_is(200)->json_is( [] );
97
98
    $schema->storage->txn_rollback;
99
};
100
101
subtest 'get() test' => sub {
102
103
    plan tests => 9;
104
105
    $schema->storage->txn_begin;
106
107
    my $vendor = Koha::Acquisition::Booksellers->find(
108
        $builder->build( { source => 'Aqbookseller' } )->{id} );
109
    my ( $borrowernumber, $session_id )
110
        = create_user_and_session( { authorized => 1 } );
111
112
    my $tx = $t->ua->build_tx( GET => "/api/v1/acquisitions/vendors/" . $vendor->id );
113
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
114
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
115
    $t->request_ok($tx)->status_is(200)
116
        ->json_is( Koha::REST::V1::Acquisitions::Vendors::_to_api($vendor) );
117
118
    my $non_existent_id = $vendor->id + 1;
119
    $tx = $t->ua->build_tx( GET => "/api/v1/acquisitions/vendors/" . $non_existent_id );
120
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
121
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
122
    $t->request_ok($tx)->status_is(404)->json_is( '/error' => 'Vendor not found' );
123
124
    my ( $unauthorized_borrowernumber, $unauthorized_session_id )
125
        = create_user_and_session( { authorized => 0 } );
126
    $tx = $t->ua->build_tx( GET => "/api/v1/acquisitions/vendors/" . $vendor->id );
127
    $tx->req->cookies( { name => 'CGISESSID', value => $unauthorized_session_id } );
128
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
129
    $t->request_ok($tx)->status_is(403)
130
        ->json_is( '/error', 'Authorization failure. Missing required permission(s).' );
131
132
    $schema->storage->txn_rollback;
133
};
134
135
subtest 'add() tests' => sub {
136
137
    plan tests => 15;
138
139
    $schema->storage->txn_begin;
140
141
    my ( $unauthorized_borrowernumber, $unauthorized_session_id )
142
        = create_user_and_session( { authorized => 0 } );
143
    my ( $authorized_borrowernumber, $authorized_session_id )
144
        = create_user_and_session( { authorized => 1 } );
145
    my $vendor = { name => 'Ruben libros' };
146
147
    # Unauthorized attempt to write
148
    my $tx = $t->ua->build_tx( POST => "/api/v1/acquisitions/vendors" => json => $vendor );
149
    $tx->req->cookies( { name => 'CGISESSID', value => $unauthorized_session_id } );
150
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
151
    $t->request_ok($tx)->status_is(403);
152
153
    # Authorized attempt to write invalid data
154
    my $vendor_with_invalid_field = {
155
        name     => 'Amerindia',
156
        address5 => 'An address'
157
    };
158
159
    $tx = $t->ua->build_tx(
160
        POST => "/api/v1/acquisitions/vendors" => json => $vendor_with_invalid_field );
161
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
162
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
163
    $t->request_ok($tx)->status_is(400)->json_is(
164
        "/errors" => [
165
            {   message => "Properties not allowed: address5.",
166
                path    => "/body"
167
            }
168
        ]
169
    );
170
171
    # Authorized attempt to write
172
    $tx = $t->ua->build_tx( POST => "/api/v1/acquisitions/vendors" => json => $vendor );
173
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
174
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
175
    my $vendor_id = $t->request_ok($tx)->status_is(200)->json_is( '/name' => $vendor->{name} )
176
        ->json_is( '/address1' => $vendor->{address1} )->tx->res->json('/id')
177
        ;    # read the response vendor id for later use
178
179
    # Authorized attempt to create with null id
180
    $vendor->{id} = undef;
181
    $tx = $t->ua->build_tx( POST => "/api/v1/acquisitions/vendors" => json => $vendor );
182
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
183
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
184
    $t->request_ok($tx)->status_is(400)->json_has('/errors');
185
186
    # Authorized attempt to create with existing id
187
    $vendor->{id} = $vendor_id;
188
    $tx = $t->ua->build_tx( POST => "/api/v1/acquisitions/vendors" => json => $vendor );
189
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
190
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
191
    $t->request_ok($tx)->status_is(400)->json_is(
192
        "/errors" => [
193
            {   message => "Read-only.",
194
                path    => "/body/id"
195
            }
196
        ]
197
    );
198
199
    $schema->storage->txn_rollback;
200
};
201
202
subtest 'update() tests' => sub {
203
204
    plan tests => 15;
205
206
    $schema->storage->txn_begin;
207
208
    my ( $unauthorized_borrowernumber, $unauthorized_session_id )
209
        = create_user_and_session( { authorized => 0 } );
210
    my ( $authorized_borrowernumber, $authorized_session_id )
211
        = create_user_and_session( { authorized => 1 } );
212
213
    my $vendor_id = $builder->build( { source => 'Aqbookseller' } )->{id};
214
215
    # Unauthorized attempt to update
216
    my $tx = $t->ua->build_tx( PUT => "/api/v1/acquisitions/vendors/$vendor_id" => json =>
217
            { city_name => 'New unauthorized name change' } );
218
    $tx->req->cookies( { name => 'CGISESSID', value => $unauthorized_session_id } );
219
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
220
    $t->request_ok($tx)->status_is(403);
221
222
    # Attempt partial update on a PUT
223
    my $vendor_without_mandatory_field = { address1 => 'New address' };
224
225
    $tx = $t->ua->build_tx( PUT => "/api/v1/acquisitions/vendors/$vendor_id" => json =>
226
            $vendor_without_mandatory_field );
227
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
228
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
229
    $t->request_ok($tx)->status_is(400)
230
        ->json_is( "/errors" => [ { message => "Missing property.", path => "/body/name" } ] );
231
232
    # Full object update on PUT
233
    my $vendor_with_updated_field = { name => "London books", };
234
235
    $tx = $t->ua->build_tx(
236
        PUT => "/api/v1/acquisitions/vendors/$vendor_id" => json => $vendor_with_updated_field );
237
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
238
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
239
    $t->request_ok($tx)->status_is(200)->json_is( '/name' => 'London books' );
240
241
    # Authorized attempt to write invalid data
242
    my $vendor_with_invalid_field = {
243
        blah     => "Blah",
244
        address1 => "Address 1",
245
        address2 => "Address 2",
246
        address3 => "Address 3"
247
    };
248
249
    $tx = $t->ua->build_tx(
250
        PUT => "/api/v1/acquisitions/vendors/$vendor_id" => json => $vendor_with_invalid_field );
251
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
252
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
253
    $t->request_ok($tx)->status_is(400)->json_is(
254
        "/errors" => [
255
            {   message => "Properties not allowed: blah.",
256
                path    => "/body"
257
            }
258
        ]
259
    );
260
261
    my $non_existent_id = $vendor_id + 1;
262
    $tx = $t->ua->build_tx( PUT => "/api/v1/acquisitions/vendors/$non_existent_id" => json =>
263
            $vendor_with_updated_field );
264
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
265
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
266
    $t->request_ok($tx)->status_is(404);
267
268
    $schema->storage->txn_rollback;
269
270
    # Wrong method (POST)
271
    $vendor_with_updated_field->{id} = 2;
272
273
    $tx = $t->ua->build_tx(
274
        POST => "/api/v1/acquisitions/vendors/$vendor_id" => json => $vendor_with_updated_field );
275
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
276
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
277
    $t->request_ok($tx)->status_is(404);
278
};
279
280
subtest 'delete() tests' => sub {
281
282
    plan tests => 7;
283
284
    $schema->storage->txn_begin;
285
286
    my ( $unauthorized_borrowernumber, $unauthorized_session_id )
287
        = create_user_and_session( { authorized => 0 } );
288
    my ( $authorized_borrowernumber, $authorized_session_id )
289
        = create_user_and_session( { authorized => 1 } );
290
291
    my $vendor_id = $builder->build( { source => 'Aqbookseller' } )->{id};
292
293
    # Unauthorized attempt to update
294
    my $tx = $t->ua->build_tx( DELETE => "/api/v1/acquisitions/vendors/$vendor_id" );
295
    $tx->req->cookies( { name => 'CGISESSID', value => $unauthorized_session_id } );
296
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
297
    $t->request_ok($tx)->status_is(403);
298
299
    $tx = $t->ua->build_tx( DELETE => "/api/v1/acquisitions/vendors/$vendor_id" );
300
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
301
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
302
    $t->request_ok($tx)->status_is(200)->content_is('');
303
304
    $tx = $t->ua->build_tx( DELETE => "/api/v1/acquisitions/vendors/$vendor_id" );
305
    $tx->req->cookies( { name => 'CGISESSID', value => $authorized_session_id } );
306
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
307
    $t->request_ok($tx)->status_is(404);
308
309
    $schema->storage->txn_rollback;
310
};
311
312
sub create_user_and_session {
313
314
    my $args = shift;
315
    my $flags = ( $args->{authorized} ) ? 2052 : 0;
316
317
    # my $flags = ( $args->{authorized} ) ? $args->{authorized} : 0;
318
    my $dbh = C4::Context->dbh;
319
320
    my $user = $builder->build(
321
        {   source => 'Borrower',
322
            value  => { flags => $flags }
323
        }
324
    );
325
326
    # Create a session for the authorized user
327
    my $session = C4::Auth::get_session('');
328
    $session->param( 'number',   $user->{borrowernumber} );
329
    $session->param( 'id',       $user->{userid} );
330
    $session->param( 'ip',       '127.0.0.1' );
331
    $session->param( 'lasttime', time() );
332
    $session->flush;
333
334
    if ( $args->{authorized} ) {
335
        $dbh->do(
336
            q{
337
            INSERT INTO user_permissions (borrowernumber,module_bit,code)
338
            VALUES (?,11,'vendors_manage')},
339
            undef, $user->{borrowernumber}
340
        );
341
    }
342
343
    return ( $user->{borrowernumber}, $session->id );
344
}
345
346
1;

Return to bug 18120