View | Details | Raw Unified | Return to bug 19784
Collapse All | Expand All

(-)a/t/db_dependent/api/v1/patrons.t (-126 / +149 lines)
Lines 40-143 subtest 'list() tests' => sub { Link Here
40
    plan tests => 2;
40
    plan tests => 2;
41
41
42
    $schema->storage->txn_begin;
42
    $schema->storage->txn_begin;
43
44
    unauthorized_access_tests('GET', undef, undef);
43
    unauthorized_access_tests('GET', undef, undef);
44
    $schema->storage->txn_rollback;
45
45
46
    subtest 'librarian access tests' => sub {
46
    subtest 'librarian access tests' => sub {
47
        plan tests => 8;
47
        plan tests => 8;
48
48
49
        my ($borrowernumber, $sessionid) = create_user_and_session({
49
        $schema->storage->txn_begin;
50
            authorized => 1 });
50
51
        my $patron = Koha::Patrons->find($borrowernumber);
51
        Koha::Patrons->search->delete;
52
        Koha::Patrons->search({
52
53
            borrowernumber => { '!=' => $borrowernumber},
53
        my ( $patron_id, $session_id ) = create_user_and_session({ authorized => 1 });
54
            cardnumber => { LIKE => $patron->cardnumber . "%" }
54
        my $patron = Koha::Patrons->find($patron_id);
55
        })->delete;
56
        Koha::Patrons->search({
57
            borrowernumber => { '!=' => $borrowernumber},
58
            address2 => { LIKE => $patron->address2 . "%" }
59
        })->delete;
60
55
61
        my $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
56
        my $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
62
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
57
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
63
        $tx->req->env({REMOTE_ADDR => '127.0.0.1'});
58
        $tx->req->env({ REMOTE_ADDR => '127.0.0.1' });
64
        $t->request_ok($tx)
59
        $t->request_ok($tx)
65
          ->status_is(200);
60
          ->status_is(200);
66
61
67
        $tx = $t->ua->build_tx(GET => '/api/v1/patrons?cardnumber='.
62
        $tx = $t->ua->build_tx(GET => '/api/v1/patrons?cardnumber=' . $patron->cardnumber);
68
                                  $patron->cardnumber);
63
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
69
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
64
        $tx->req->env({ REMOTE_ADDR => '127.0.0.1' });
70
        $tx->req->env({REMOTE_ADDR => '127.0.0.1'});
71
        $t->request_ok($tx)
65
        $t->request_ok($tx)
72
          ->status_is(200)
66
          ->status_is(200)
73
          ->json_is('/0/cardnumber' => $patron->cardnumber);
67
          ->json_is('/0/cardnumber' => $patron->cardnumber);
74
68
75
        $tx = $t->ua->build_tx(GET => '/api/v1/patrons?address2='.
69
        $tx = $t->ua->build_tx(GET => '/api/v1/patrons?address2='.
76
                                  $patron->address2);
70
                                  $patron->address2);
77
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
71
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
78
        $tx->req->env({REMOTE_ADDR => '127.0.0.1'});
72
        $tx->req->env({ REMOTE_ADDR => '127.0.0.1' });
79
        $t->request_ok($tx)
73
        $t->request_ok($tx)
80
          ->status_is(200)
74
          ->status_is(200)
81
          ->json_is('/0/address2' => $patron->address2);
75
          ->json_is('/0/address2' => $patron->address2);
82
    };
83
76
84
    $schema->storage->txn_rollback;
77
        $schema->storage->txn_rollback;
78
    };
85
};
79
};
86
80
87
subtest 'get() tests' => sub {
81
subtest 'get() tests' => sub {
88
    plan tests => 3;
82
    plan tests => 3;
89
83
90
    $schema->storage->txn_begin;
84
    $schema->storage->txn_begin;
91
92
    unauthorized_access_tests('GET', -1, undef);
85
    unauthorized_access_tests('GET', -1, undef);
86
    $schema->storage->txn_rollback;
93
87
94
    subtest 'access own object tests' => sub {
88
    subtest 'access own object tests' => sub {
95
        plan tests => 4;
89
        plan tests => 4;
96
90
97
        my ($patronid, $patronsessionid) = create_user_and_session({
91
        $schema->storage->txn_begin;
98
            authorized => 0 });
92
93
        my ( $patron_id, $session_id ) = create_user_and_session({ authorized => 0 });
99
94
100
        # Access patron's own data even though they have no borrowers flag
95
        # Access patron's own data even though they have no borrowers flag
101
        my $tx = $t->ua->build_tx(GET => "/api/v1/patrons/$patronid");
96
        my $tx = $t->ua->build_tx(GET => "/api/v1/patrons/" . $patron_id);
102
        $tx->req->cookies({name => 'CGISESSID', value => $patronsessionid});
97
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
103
        $tx->req->env({REMOTE_ADDR => '127.0.0.1'});
98
        $tx->req->env({ REMOTE_ADDR => '127.0.0.1' });
104
        $t->request_ok($tx)
99
        $t->request_ok($tx)
105
          ->status_is(200);
100
          ->status_is(200);
106
101
107
        my $guarantee = $builder->build({
102
        my $guarantee = $builder->build_object({
108
            source => 'Borrower',
103
            class => 'Koha::Patrons',
109
            value  => {
104
            value => {
110
                guarantorid => $patronid,
105
                guarantorid => $patron_id,
111
            }
106
            }
112
        });
107
        });
113
108
114
        # Access guarantee's data even though guarantor has no borrowers flag
109
        # Access guarantee's data even though guarantor has no borrowers flag
115
        my $guaranteenumber = $guarantee->{borrowernumber};
110
        $tx = $t->ua->build_tx(GET => "/api/v1/patrons/" . $guarantee->id );
116
        $tx = $t->ua->build_tx(GET => "/api/v1/patrons/$guaranteenumber");
111
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
117
        $tx->req->cookies({name => 'CGISESSID', value => $patronsessionid});
112
        $tx->req->env({ REMOTE_ADDR => '127.0.0.1' });
118
        $tx->req->env({REMOTE_ADDR => '127.0.0.1'});
119
        $t->request_ok($tx)
113
        $t->request_ok($tx)
120
          ->status_is(200);
114
          ->status_is(200);
115
116
        $schema->storage->txn_rollback;
121
    };
117
    };
122
118
123
    subtest 'librarian access tests' => sub {
119
    subtest 'librarian access tests' => sub {
124
        plan tests => 5;
120
        plan tests => 6;
125
121
126
        my ($patron_id) = create_user_and_session({
122
        $schema->storage->txn_begin;
127
            authorized => 0 });
123
128
        my $patron = Koha::Patrons->find($patron_id);
124
        my $patron = $builder->build_object({ class => 'Koha::Patrons' });
129
        my ($borrowernumber, $sessionid) = create_user_and_session({
125
        my ( undef, $session_id ) = create_user_and_session({ authorized => 1 });
130
            authorized => 1 });
126
131
        my $tx = $t->ua->build_tx(GET => "/api/v1/patrons/$patron_id");
127
        my $tx = $t->ua->build_tx(GET => "/api/v1/patrons/" . $patron->id);
132
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
128
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
133
        $t->request_ok($tx)
129
        $t->request_ok($tx)
134
          ->status_is(200)
130
          ->status_is(200)
135
          ->json_is('/borrowernumber' => $patron_id)
131
          ->json_is('/patron_id'   => $patron->id)
136
          ->json_is('/surname' => $patron->surname)
132
          ->json_is('/category_id' => $patron->categorycode )
137
          ->json_is('/lost' => Mojo::JSON->false );
133
          ->json_is('/surname'     => $patron->surname)
138
    };
134
          ->json_is('/lost'        => Mojo::JSON->false );
139
135
140
    $schema->storage->txn_rollback;
136
        $schema->storage->txn_rollback;
137
    };
141
};
138
};
142
139
143
subtest 'add() tests' => sub {
140
subtest 'add() tests' => sub {
Lines 145-264 subtest 'add() tests' => sub { Link Here
145
142
146
    $schema->storage->txn_begin;
143
    $schema->storage->txn_begin;
147
144
148
    my $categorycode = $builder->build({ source => 'Category' })->{categorycode};
145
    my $patron = Koha::REST::V1::Patrons::_to_api(
149
    my $branchcode = $builder->build({ source => 'Branch' })->{branchcode};
146
        $builder->build_object( { class => 'Koha::Patrons' } )->TO_JSON );
150
    my $newpatron = {
151
        address      => 'Street',
152
        branchcode   => $branchcode,
153
        cardnumber   => $branchcode.$categorycode,
154
        categorycode => $categorycode,
155
        city         => 'Joenzoo',
156
        surname      => "TestUser",
157
        userid       => $branchcode.$categorycode,
158
    };
159
147
160
    unauthorized_access_tests('POST', undef, $newpatron);
148
    unauthorized_access_tests('POST', undef, $patron);
149
150
    $schema->storage->txn_rollback;
161
151
162
    subtest 'librarian access tests' => sub {
152
    subtest 'librarian access tests' => sub {
163
        plan tests => 18;
153
        plan tests => 18;
164
154
165
        my ($borrowernumber, $sessionid) = create_user_and_session({
155
        $schema->storage->txn_begin;
166
            authorized => 1 });
156
157
        my $patron = $builder->build_object({ class => 'Koha::Patrons' });
158
        my $newpatron = Koha::REST::V1::Patrons::_to_api( $patron->TO_JSON );
159
        delete $newpatron->{patron_id};
160
161
        # Create a library just to make sure its ID doesn't exist on the DB
162
        my $library_to_delete = $builder->build_object({ class => 'Koha::Libraries' });
163
        my $deleted_library_id = $library_to_delete->id;
164
        # Delete library
165
        $library_to_delete->delete;
167
166
168
        $newpatron->{branchcode} = "nonexistent"; # Test invalid branchcode
167
        my ( undef, $session_id ) = create_user_and_session({ authorized => 1 });
168
169
        $newpatron->{library_id} = $deleted_library_id;
169
        my $tx = $t->ua->build_tx(POST => "/api/v1/patrons" => json => $newpatron );
170
        my $tx = $t->ua->build_tx(POST => "/api/v1/patrons" => json => $newpatron );
170
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
171
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
171
        $t->request_ok($tx)
172
        $t->request_ok($tx)
172
          ->status_is(400)
173
          ->status_is(400)
173
          ->json_is('/error' => "Given branchcode does not exist");
174
          ->json_is('/error' => "Given library_id does not exist");
174
        $newpatron->{branchcode} = $branchcode;
175
        $newpatron->{library_id} = $patron->branchcode;
176
177
        # Create a library just to make sure its ID doesn't exist on the DB
178
        my $category_to_delete = $builder->build_object({ class => 'Koha::Patron::Categories' });
179
        my $deleted_category_id = $category_to_delete->id;
180
        # Delete library
181
        $category_to_delete->delete;
175
182
176
        $newpatron->{categorycode} = "nonexistent"; # Test invalid patron category
183
        $newpatron->{category_id} = $deleted_category_id; # Test invalid patron category
177
        $tx = $t->ua->build_tx(POST => "/api/v1/patrons" => json => $newpatron);
184
        $tx = $t->ua->build_tx(POST => "/api/v1/patrons" => json => $newpatron);
178
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
185
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
179
        $t->request_ok($tx)
186
        $t->request_ok($tx)
180
          ->status_is(400)
187
          ->status_is(400)
181
          ->json_is('/error' => "Given categorycode does not exist");
188
          ->json_is('/error' => "Given category_id does not exist");
182
        $newpatron->{categorycode} = $categorycode;
189
        $newpatron->{category_id} = $patron->categorycode;
183
190
184
        $newpatron->{falseproperty} = "Non existent property";
191
        $newpatron->{falseproperty} = "Non existent property";
185
        $tx = $t->ua->build_tx(POST => "/api/v1/patrons" => json => $newpatron);
192
        $tx = $t->ua->build_tx(POST => "/api/v1/patrons" => json => $newpatron);
186
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
193
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
187
        $t->request_ok($tx)
194
        $t->request_ok($tx)
188
          ->status_is(400);
195
          ->status_is(400);
189
        delete $newpatron->{falseproperty};
196
        delete $newpatron->{falseproperty};
190
197
198
        my $patron_to_delete = $builder->build_object({ class => 'Koha::Patrons' });
199
        $newpatron = Koha::REST::V1::Patrons::_to_api($patron_to_delete->TO_JSON);
200
        delete $newpatron->{patron_id};
201
        $patron_to_delete->delete;
202
191
        $tx = $t->ua->build_tx(POST => "/api/v1/patrons" => json => $newpatron);
203
        $tx = $t->ua->build_tx(POST => "/api/v1/patrons" => json => $newpatron);
192
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
204
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
193
        $t->request_ok($tx)
205
        $t->request_ok($tx)
194
          ->status_is(201, 'Patron created successfully')
206
          ->status_is(201, 'Patron created successfully')
195
          ->json_has('/borrowernumber', 'got a borrowernumber')
207
          ->json_has('/patron_id', 'got a patron_id')
196
          ->json_is('/cardnumber', $newpatron->{ cardnumber })
208
          ->json_is( '/cardnumber' => $newpatron->{ cardnumber })
197
          ->json_is('/surname' => $newpatron->{ surname })
209
          ->json_is( '/surname'    => $newpatron->{ surname })
198
          ->json_is('/firstname' => $newpatron->{ firstname });
210
          ->json_is( '/firstname'  => $newpatron->{ firstname });
199
        $newpatron->{borrowernumber} = $tx->res->json->{borrowernumber};
200
211
201
        $tx = $t->ua->build_tx(POST => "/api/v1/patrons" => json => $newpatron);
212
        $tx = $t->ua->build_tx(POST => "/api/v1/patrons" => json => $newpatron);
202
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
213
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
203
        $t->request_ok($tx)
214
        $t->request_ok($tx)
204
          ->status_is(409)
215
          ->status_is(409)
205
          ->json_has('/error', 'Fails when trying to POST duplicate'.
216
          ->json_has('/error', 'Fails when trying to POST duplicate cardnumber or userid')
206
                     ' cardnumber or userid')
207
          ->json_has('/conflict', {
217
          ->json_has('/conflict', {
208
                        userid => $newpatron->{ userid },
218
                        userid => $newpatron->{ userid },
209
                        cardnumber => $newpatron->{ cardnumber }
219
                        cardnumber => $newpatron->{ cardnumber }
210
                    }
220
                    }
211
            );
221
            );
212
    };
213
222
214
    $schema->storage->txn_rollback;
223
        $schema->storage->txn_rollback;
224
    };
215
};
225
};
216
226
217
subtest 'update() tests' => sub {
227
subtest 'update() tests' => sub {
218
    plan tests => 2;
228
    plan tests => 2;
219
229
220
    $schema->storage->txn_begin;
230
    $schema->storage->txn_begin;
221
222
    unauthorized_access_tests('PUT', 123, {email => 'nobody@example.com'});
231
    unauthorized_access_tests('PUT', 123, {email => 'nobody@example.com'});
232
    $schema->storage->txn_rollback;
223
233
224
    subtest 'librarian access tests' => sub {
234
    subtest 'librarian access tests' => sub {
225
        plan tests => 20;
235
        plan tests => 20;
226
236
237
        $schema->storage->txn_begin;
238
227
        t::lib::Mocks::mock_preference('minPasswordLength', 1);
239
        t::lib::Mocks::mock_preference('minPasswordLength', 1);
228
        my ($borrowernumber, $sessionid) = create_user_and_session({ authorized => 1 });
240
        my ( $patron_id_1, $session_id ) = create_user_and_session({ authorized => 1 });
229
        my ($borrowernumber2, undef) = create_user_and_session({ authorized => 0 });
241
        my ( $patron_id_2, undef )       = create_user_and_session({ authorized => 0 });
230
242
231
        my $patron_1  = Koha::Patrons->find($borrowernumber);
243
        my $patron_1  = Koha::Patrons->find($patron_id_1);
232
        my $patron_2  = Koha::Patrons->find($borrowernumber2);
244
        my $patron_2  = Koha::Patrons->find($patron_id_2);
233
        my $newpatron = $patron_2->TO_JSON;
245
        my $newpatron = Koha::REST::V1::Patrons::_to_api($patron_2->TO_JSON);
234
        # borrowernumber should not be passed in the request body for PUT
246
        # borrowernumber should not be passed in the request body for PUT
235
        delete $newpatron->{borrowernumber};
247
        delete $newpatron->{borrowernumber};
236
248
237
        my $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/-1" => json => $newpatron );
249
        my $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/-1" => json => $newpatron );
238
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
250
        $tx->req->cookies({name => 'CGISESSID', value => $session_id});
239
        $t->request_ok($tx)
251
        $t->request_ok($tx)
240
          ->status_is(404)
252
          ->status_is(404)
241
          ->json_has('/error', 'Fails when trying to PUT nonexistent patron');
253
          ->json_has('/error', 'Fails when trying to PUT nonexistent patron');
242
254
243
        $newpatron->{categorycode} = 'nonexistent';
255
        # Create a library just to make sure its ID doesn't exist on the DB
244
        $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/$borrowernumber2" => json => $newpatron );
256
        my $category_to_delete = $builder->build_object({ class => 'Koha::Patron::Categories' });
245
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
257
        my $deleted_category_id = $category_to_delete->id;
258
        # Delete library
259
        $category_to_delete->delete;
260
261
        $newpatron->{category_id} = $deleted_category_id;
262
        $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/$patron_id_2" => json => $newpatron );
263
        $tx->req->cookies({name => 'CGISESSID', value => $session_id});
246
        $t->request_ok($tx)
264
        $t->request_ok($tx)
247
          ->status_is(400)
265
          ->status_is(400)
248
          ->json_is('/error' => "Given categorycode does not exist");
266
          ->json_is('/error' => "Given category_id does not exist");
249
        $newpatron->{categorycode} = $patron_2->categorycode;
267
        $newpatron->{category_id} = $patron_2->categorycode;
250
268
251
        $newpatron->{branchcode} = 'nonexistent';
269
        # Create a library just to make sure its ID doesn't exist on the DB
252
        $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/$borrowernumber2" => json => $newpatron );
270
        my $library_to_delete = $builder->build_object({ class => 'Koha::Libraries' });
253
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
271
        my $deleted_library_id = $library_to_delete->id;
272
        # Delete library
273
        $library_to_delete->delete;
274
275
        $newpatron->{library_id} = $deleted_library_id;
276
        $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/$patron_id_2" => json => $newpatron );
277
        $tx->req->cookies({name => 'CGISESSID', value => $session_id});
254
        $t->request_ok($tx)
278
        $t->request_ok($tx)
255
          ->status_is(400)
279
          ->status_is(400)
256
          ->json_is('/error' => "Given branchcode does not exist");
280
          ->json_is('/error' => "Given library_id does not exist");
257
        $newpatron->{branchcode} = $patron_2->branchcode;
281
        $newpatron->{library_id} = $patron_2->branchcode;
258
282
259
        $newpatron->{falseproperty} = "Non existent property";
283
        $newpatron->{falseproperty} = "Non existent property";
260
        $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/$borrowernumber2" => json => $newpatron );
284
        $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/$patron_id_2" => json => $newpatron );
261
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
285
        $tx->req->cookies({name => 'CGISESSID', value => $session_id});
262
        $t->request_ok($tx)
286
        $t->request_ok($tx)
263
          ->status_is(400)
287
          ->status_is(400)
264
          ->json_is('/errors/0/message' =>
288
          ->json_is('/errors/0/message' =>
Lines 269-276 subtest 'update() tests' => sub { Link Here
269
        $newpatron->{cardnumber} = $patron_1->cardnumber;
293
        $newpatron->{cardnumber} = $patron_1->cardnumber;
270
        $newpatron->{userid}     = $patron_1->userid;
294
        $newpatron->{userid}     = $patron_1->userid;
271
295
272
        $tx = $t->ua->build_tx( PUT => "/api/v1/patrons/$borrowernumber2" => json => $newpatron );
296
        $tx = $t->ua->build_tx( PUT => "/api/v1/patrons/$patron_id_2" => json => $newpatron );
273
        $tx->req->cookies({ name => 'CGISESSID', value => $sessionid });
297
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
274
        $t->request_ok($tx)->status_is(409)
298
        $t->request_ok($tx)->status_is(409)
275
          ->json_has( '/error' => "Fails when trying to update to an existing cardnumber or userid")
299
          ->json_has( '/error' => "Fails when trying to update to an existing cardnumber or userid")
276
          ->json_is(  '/conflict',
300
          ->json_is(  '/conflict',
Lines 280-337 subtest 'update() tests' => sub { Link Here
280
                        }
304
                        }
281
          );
305
          );
282
306
283
        $newpatron->{ cardnumber } = $borrowernumber.$borrowernumber2;
307
        $newpatron->{ cardnumber } = $patron_id_1.$patron_id_2;
284
        $newpatron->{ userid } = "user".$borrowernumber.$borrowernumber2;
308
        $newpatron->{ userid }     = "user".$patron_id_1.$patron_id_2;
285
        $newpatron->{ surname } = "user".$borrowernumber.$borrowernumber2;
309
        $newpatron->{ surname }    = "user".$patron_id_1.$patron_id_2;
286
310
287
        $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/" . $patron_2->id => json => $newpatron);
311
        $tx = $t->ua->build_tx(PUT => "/api/v1/patrons/" . $patron_2->id => json => $newpatron);
288
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
312
        $tx->req->cookies({name => 'CGISESSID', value => $session_id});
289
        $t->request_ok($tx)
313
        $t->request_ok($tx)
290
          ->status_is(200, 'Patron updated successfully')
314
          ->status_is(200, 'Patron updated successfully')
291
          ->json_has($newpatron);
315
          ->json_has($newpatron);
292
        is(Koha::Patrons->find( $patron_2->id )->cardnumber,
316
        is(Koha::Patrons->find( $patron_2->id )->cardnumber,
293
           $newpatron->{ cardnumber }, 'Patron is really updated!');
317
           $newpatron->{ cardnumber }, 'Patron is really updated!');
294
    };
295
318
296
    $schema->storage->txn_rollback;
319
        $schema->storage->txn_rollback;
320
    };
297
};
321
};
298
322
299
subtest 'delete() tests' => sub {
323
subtest 'delete() tests' => sub {
300
    plan tests => 2;
324
    plan tests => 2;
301
325
302
    $schema->storage->txn_begin;
326
    $schema->storage->txn_begin;
303
304
    unauthorized_access_tests('DELETE', 123, undef);
327
    unauthorized_access_tests('DELETE', 123, undef);
328
    $schema->storage->txn_rollback;
305
329
306
    subtest 'librarian access test' => sub {
330
    subtest 'librarian access test' => sub {
307
        plan tests => 4;
331
        plan tests => 4;
308
332
309
        my ($borrowernumber, $sessionid) = create_user_and_session({
333
        $schema->storage->txn_begin;
310
            authorized => 1 });
334
311
        my ($borrowernumber2, $sessionid2) = create_user_and_session({
335
        my ( undef, $session_id ) = create_user_and_session({ authorized => 1 });
312
            authorized => 0 });
336
        my ( $patron_id, undef )  = create_user_and_session({ authorized => 0 });
313
337
314
        my $tx = $t->ua->build_tx(DELETE => "/api/v1/patrons/-1");
338
        my $tx = $t->ua->build_tx(DELETE => "/api/v1/patrons/-1");
315
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
339
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
316
        $t->request_ok($tx)
340
        $t->request_ok($tx)
317
          ->status_is(404, 'Patron not found');
341
          ->status_is(404, 'Patron not found');
318
342
319
        $tx = $t->ua->build_tx(DELETE => "/api/v1/patrons/$borrowernumber2");
343
        $tx = $t->ua->build_tx(DELETE => "/api/v1/patrons/$patron_id");
320
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
344
        $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
321
        $t->request_ok($tx)
345
        $t->request_ok($tx)
322
          ->status_is(200, 'Patron deleted successfully');
346
          ->status_is(200, 'Patron deleted successfully');
323
    };
324
347
325
    $schema->storage->txn_rollback;
348
        $schema->storage->txn_rollback;
349
    };
326
};
350
};
327
351
328
# Centralized tests for 401s and 403s assuming the endpoint requires
352
# Centralized tests for 401s and 403s assuming the endpoint requires
329
# borrowers flag for access
353
# borrowers flag for access
330
sub unauthorized_access_tests {
354
sub unauthorized_access_tests {
331
    my ($verb, $patronid, $json) = @_;
355
    my ($verb, $patron_id, $json) = @_;
332
356
333
    my $endpoint = '/api/v1/patrons';
357
    my $endpoint = '/api/v1/patrons';
334
    $endpoint .= ($patronid) ? "/$patronid" : '';
358
    $endpoint .= ($patron_id) ? "/$patron_id" : '';
335
359
336
    subtest 'unauthorized access tests' => sub {
360
    subtest 'unauthorized access tests' => sub {
337
        plan tests => 5;
361
        plan tests => 5;
Lines 340-350 sub unauthorized_access_tests { Link Here
340
        $t->request_ok($tx)
364
        $t->request_ok($tx)
341
          ->status_is(401);
365
          ->status_is(401);
342
366
343
        my ($borrowernumber, $sessionid) = create_user_and_session({
367
        my ($borrowernumber, $session_id) = create_user_and_session({
344
            authorized => 0 });
368
            authorized => 0 });
345
369
346
        $tx = $t->ua->build_tx($verb => $endpoint => json => $json);
370
        $tx = $t->ua->build_tx($verb => $endpoint => json => $json);
347
        $tx->req->cookies({name => 'CGISESSID', value => $sessionid});
371
        $tx->req->cookies({name => 'CGISESSID', value => $session_id});
348
        $t->request_ok($tx)
372
        $t->request_ok($tx)
349
          ->status_is(403)
373
          ->status_is(403)
350
          ->json_is('/required_permissions', {"borrowers" => "1"});
374
          ->json_is('/required_permissions', {"borrowers" => "1"});
351
- 

Return to bug 19784