Lines 186-192
subtest "Test endpoints without permission" => sub {
Link Here
|
186 |
->status_is(403); |
186 |
->status_is(403); |
187 |
}; |
187 |
}; |
188 |
subtest "Test endpoints without permission, but accessing own object" => sub { |
188 |
subtest "Test endpoints without permission, but accessing own object" => sub { |
189 |
plan tests => 15; |
189 |
plan tests => 25; |
190 |
|
190 |
|
191 |
my $borrno_tmp = $post_data->{'borrowernumber'}; |
191 |
my $borrno_tmp = $post_data->{'borrowernumber'}; |
192 |
$post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'}; |
192 |
$post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'}; |
Lines 210-220
subtest "Test endpoints without permission, but accessing own object" => sub {
Link Here
|
210 |
my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id; |
210 |
my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id; |
211 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data); |
211 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data); |
212 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
212 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
213 |
$t->request_ok($tx) # create hold to myself |
213 |
$t->request_ok($tx) |
214 |
->status_is(200) |
214 |
->status_is(200) |
215 |
->json_is('/reserve_id', $reserve_id3) |
215 |
->json_is('/reserve_id', $reserve_id3) |
216 |
->json_is('/suspend_until', $suspend_until . ' 00:00:00') |
216 |
->json_is('/suspend_until', $suspend_until . ' 00:00:00') |
217 |
->json_is('/priority', 2); |
217 |
->json_is('/priority', 2); |
|
|
218 |
|
219 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => { |
220 |
suspend => Mojo::JSON->false |
221 |
}); |
222 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
223 |
$t->request_ok($tx) |
224 |
->status_is(200) |
225 |
->json_is('/reserve_id', $reserve_id3) |
226 |
->json_is('/suspend', Mojo::JSON->false) |
227 |
->json_is('/suspend_until', undef); |
228 |
|
229 |
$tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => { |
230 |
suspend_until => $suspend_until |
231 |
}); |
232 |
$tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id}); |
233 |
$t->request_ok($tx) |
234 |
->status_is(200) |
235 |
->json_is('/reserve_id', $reserve_id3) |
236 |
->json_is('/suspend', Mojo::JSON->true) |
237 |
->json_like('/suspend_until', qr/^$suspend_until/); |
218 |
}; |
238 |
}; |
219 |
|
239 |
|
220 |
subtest "Test endpoints with permission" => sub { |
240 |
subtest "Test endpoints with permission" => sub { |
221 |
- |
|
|