View | Details | Raw Unified | Return to bug 22071
Collapse All | Expand All

(-)a/t/db_dependent/api/v1/auth_authenticate_api_request.t (-1 / +146 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/env perl
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it under the
6
# terms of the GNU General Public License as published by the Free Software
7
# Foundation; either version 3 of the License, or (at your option) any later
8
# version.
9
#
10
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
11
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
12
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
13
#
14
# You should have received a copy of the GNU General Public License along
15
# with Koha; if not, write to the Free Software Foundation, Inc.,
16
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
17
18
use Modern::Perl;
19
20
use Test::More tests => 2;
21
use Test::MockModule;
22
use Test::Mojo;
23
24
use Module::Load::Conditional qw(can_load);
25
26
use Koha::ApiKeys;
27
use Koha::Database;
28
use Koha::Patrons;
29
30
use t::lib::Mocks;
31
use t::lib::TestBuilder;
32
33
my $t = Test::Mojo->new('Koha::REST::V1');
34
my $schema  = Koha::Database->new->schema;
35
my $builder = t::lib::TestBuilder->new();
36
37
my $remote_address = '127.0.0.1';
38
my $tx;
39
40
# FIXME: CGI::Session::Driver::DBI explicitly sets AutoCommit=1 [1] which breaks the rollback in out tests.
41
# Until we change into some other library, set SessionStorage to 'tmp'
42
# [1] https://metacpan.org/source/CGI::Session::Driver::DBI#L28
43
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
44
45
subtest 'token-based tests' => sub {
46
47
    if ( can_load( modules => { 'Net::OAuth2::AuthorizationServer' => undef } ) ) {
48
        plan tests => 10;
49
    }
50
    else {
51
        plan skip_all => 'Net::OAuth2::AuthorizationServer not available';
52
    }
53
54
    $schema->storage->txn_begin;
55
56
    my $patron = $builder->build_object({
57
        class => 'Koha::Patrons',
58
        value  => {
59
            flags => 16 # no permissions
60
        },
61
    });
62
63
    t::lib::Mocks::mock_preference('RESTOAuth2ClientCredentials', 1);
64
65
    my $api_key = Koha::ApiKey->new({ patron_id => $patron->id, description => 'blah' })->store;
66
67
    my $formData = {
68
        grant_type    => 'client_credentials',
69
        client_id     => $api_key->client_id,
70
        client_secret => $api_key->secret
71
    };
72
    $t->post_ok('/api/v1/oauth/token', form => $formData)
73
        ->status_is(200)
74
        ->json_is('/expires_in' => 3600)
75
        ->json_is('/token_type' => 'Bearer')
76
        ->json_has('/access_token');
77
78
    my $access_token = $t->tx->res->json->{access_token};
79
80
    # With access token and permissions, it returns 200
81
    $patron->flags(2**4)->store;
82
83
    my $stash;
84
85
    my $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
86
    $tx->req->headers->authorization("Bearer $access_token");
87
88
    $t->app->hook(after_dispatch => sub { $stash = shift->stash });
89
    $t->request_ok($tx)->status_is(200);
90
91
    my $user = $stash->{'koha.user'};
92
    ok( defined $user, 'The \'koha.user\' object is defined in the stash') and
93
    is( ref($user), 'Koha::Patron', 'Stashed koha.user object type is Koha::Patron') and
94
    is( $user->borrowernumber, $patron->borrowernumber, 'The stashed user is the right one' );
95
96
    $schema->storage->txn_rollback;
97
};
98
99
subtest 'cookie-based tests' => sub {
100
101
    plan tests => 5;
102
103
    $schema->storage->txn_begin;
104
105
    my ( $borrowernumber, $session_id ) = create_user_and_session({ authorized => 1 });
106
107
    $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
108
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
109
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
110
111
    my $stash;
112
    $t->app->hook(after_dispatch => sub { $stash = shift->stash });
113
    $t->request_ok($tx)->status_is(200);
114
115
    my $user = $stash->{'koha.user'};
116
    ok( defined $user, 'The \'koha.user\' object is defined in the stash') and
117
    is( ref($user), 'Koha::Patron', 'Stashed koha.user object type is Koha::Patron') and
118
    is( $user->borrowernumber, $borrowernumber, 'The stashed user is the right one' );
119
120
    $schema->storage->txn_rollback;
121
};
122
123
sub create_user_and_session {
124
125
    my $args  = shift;
126
    my $flags = ( $args->{authorized} ) ? 16 : 0;
127
128
    my $user = $builder->build(
129
        {
130
            source => 'Borrower',
131
            value  => {
132
                flags => $flags
133
            }
134
        }
135
    );
136
137
    # Create a session for the authorized user
138
    my $session = C4::Auth::get_session('');
139
    $session->param( 'number',   $user->{borrowernumber} );
140
    $session->param( 'id',       $user->{userid} );
141
    $session->param( 'ip',       '127.0.0.1' );
142
    $session->param( 'lasttime', time() );
143
    $session->flush;
144
145
    return ( $user->{borrowernumber}, $session->id );
146
}

Return to bug 22071