View | Details | Raw Unified | Return to bug 21198
Collapse All | Expand All

(-)a/t/db_dependent/api/v1/auth_authenticate_api_request.t (-54 / +112 lines)
Lines 41-120 my $tx; Link Here
41
# [1] https://metacpan.org/source/CGI::Session::Driver::DBI#L28
41
# [1] https://metacpan.org/source/CGI::Session::Driver::DBI#L28
42
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
42
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
43
43
44
subtest 'token-based tests' => sub {
44
subtest 'stash the user' => sub {
45
45
46
    if ( can_load( modules => { 'Net::OAuth2::AuthorizationServer' => undef } ) ) {
46
    subtest 'token-based tests' => sub {
47
        plan tests => 10;
48
    }
49
    else {
50
        plan skip_all => 'Net::OAuth2::AuthorizationServer not available';
51
    }
52
47
53
    $schema->storage->txn_begin;
48
        if ( can_load( modules => { 'Net::OAuth2::AuthorizationServer' => undef } ) ) {
49
            plan tests => 10;
50
        }
51
        else {
52
            plan skip_all => 'Net::OAuth2::AuthorizationServer not available';
53
        }
54
55
        $schema->storage->txn_begin;
56
57
        my $patron = $builder->build_object({
58
            class => 'Koha::Patrons',
59
            value  => {
60
                flags => 16 # no permissions
61
            },
62
        });
63
64
        t::lib::Mocks::mock_preference('RESTOAuth2ClientCredentials', 1);
65
66
        my $api_key = Koha::ApiKey->new({ patron_id => $patron->id, description => 'blah' })->store;
67
68
        my $formData = {
69
            grant_type    => 'client_credentials',
70
            client_id     => $api_key->client_id,
71
            client_secret => $api_key->secret
72
        };
73
        $t->post_ok('/api/v1/oauth/token', form => $formData)
74
            ->status_is(200)
75
            ->json_is('/expires_in' => 3600)
76
            ->json_is('/token_type' => 'Bearer')
77
            ->json_has('/access_token');
78
79
        my $access_token = $t->tx->res->json->{access_token};
80
81
        my $stash;
54
82
55
    my $patron = $builder->build_object({
83
        my $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
56
        class => 'Koha::Patrons',
84
        $tx->req->headers->authorization("Bearer $access_token");
57
        value  => {
58
            flags => 16 # no permissions
59
        },
60
    });
61
85
62
    t::lib::Mocks::mock_preference('RESTOAuth2ClientCredentials', 1);
86
        $t->app->hook(after_dispatch => sub { $stash = shift->stash });
87
        $t->request_ok($tx)->status_is(200);
63
88
64
    my $api_key = Koha::ApiKey->new({ patron_id => $patron->id, description => 'blah' })->store;
89
        my $user = $stash->{'koha.user'};
90
        ok( defined $user, 'The \'koha.user\' object is defined in the stash') and
91
        is( ref($user), 'Koha::Patron', 'Stashed koha.user object type is Koha::Patron') and
92
        is( $user->borrowernumber, $patron->borrowernumber, 'The stashed user is the right one' );
65
93
66
    my $formData = {
94
        $schema->storage->txn_rollback;
67
        grant_type    => 'client_credentials',
68
        client_id     => $api_key->client_id,
69
        client_secret => $api_key->secret
70
    };
95
    };
71
    $t->post_ok('/api/v1/oauth/token', form => $formData)
72
        ->status_is(200)
73
        ->json_is('/expires_in' => 3600)
74
        ->json_is('/token_type' => 'Bearer')
75
        ->json_has('/access_token');
76
96
77
    my $access_token = $t->tx->res->json->{access_token};
97
    subtest 'cookie-based tests' => sub {
78
98
79
    # With access token and permissions, it returns 200
99
        plan tests => 5;
80
    #$patron->flags(2**4)->store;
81
100
82
    my $stash;
101
        $schema->storage->txn_begin;
83
102
84
    my $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
103
        my ( $patron, $session_id ) = create_user_and_session({ authorized => 1 });
85
    $tx->req->headers->authorization("Bearer $access_token");
86
104
87
    $t->app->hook(after_dispatch => sub { $stash = shift->stash });
105
        $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
88
    $t->request_ok($tx)->status_is(200);
106
        $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
107
        $tx->req->env( { REMOTE_ADDR => $remote_address } );
89
108
90
    my $user = $stash->{'koha.user'};
109
        my $stash;
91
    ok( defined $user, 'The \'koha.user\' object is defined in the stash') and
110
        $t->app->hook(after_dispatch => sub { $stash = shift->stash });
92
    is( ref($user), 'Koha::Patron', 'Stashed koha.user object type is Koha::Patron') and
111
        $t->request_ok($tx)->status_is(200);
93
    is( $user->borrowernumber, $patron->borrowernumber, 'The stashed user is the right one' );
94
112
95
    $schema->storage->txn_rollback;
113
        my $user = $stash->{'koha.user'};
114
        ok( defined $user, 'The \'koha.user\' object is defined in the stash') and
115
        is( ref($user), 'Koha::Patron', 'Stashed koha.user object type is Koha::Patron') and
116
        is( $user->borrowernumber, $patron->borrowernumber, 'The stashed user is the right one' );
117
118
        $schema->storage->txn_rollback;
119
    };
96
};
120
};
97
121
98
subtest 'cookie-based tests' => sub {
122
subtest 'stash the reason the user was granted access' => sub {
99
123
100
    plan tests => 5;
124
    plan tests => 12;
101
125
102
    $schema->storage->txn_begin;
126
    $schema->storage->txn_begin;
103
127
104
    my ( $borrowernumber, $session_id ) = create_user_and_session({ authorized => 1 });
128
    my ( $patron, $session_id ) = create_user_and_session({ authorized => 0 });
105
129
106
    $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
130
    my ( $stash, $reason );
131
132
    my $other_patron = $builder->build_object({ class => 'Koha::Patrons' });
133
134
    $tx = $t->ua->build_tx( GET => "/api/v1/patrons/" . $other_patron->borrowernumber );
135
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
136
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
137
138
    $t->app->hook(after_dispatch => sub { $stash = shift->stash });
139
    $t->request_ok($tx)->status_is(403);
140
141
    $reason = $stash->{'grant_reason'};
142
    is( $reason, undef, "no grant_reason is stashed when no permissions" );
143
144
    $tx = $t->ua->build_tx( GET => "/api/v1/patrons/" . $patron->borrowernumber );
145
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
146
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
147
148
    $t->app->hook(after_dispatch => sub { $stash = shift->stash });
149
    $t->request_ok($tx)->status_is(200);
150
151
    $reason = $stash->{'grant_reason'};
152
    is( $reason, 'owner', "grant_reason is 'owner'" );
153
154
    my $guarantee = $builder->build_object({ class => 'Koha::Patrons', value => { guarantorid => $patron->borrowernumber } });
155
156
    $tx = $t->ua->build_tx( GET => "/api/v1/patrons/" . $guarantee->borrowernumber );
157
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
158
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
159
160
    $t->app->hook(after_dispatch => sub { $stash = shift->stash });
161
    $t->request_ok($tx)->status_is(200);
162
163
    $reason = $stash->{'grant_reason'};
164
    is( $reason, 'guarantor', "grant_reason is 'guarantor'" );
165
166
    $patron->flags(2**4)->store; #
167
168
    $tx = $t->ua->build_tx( GET => "/api/v1/patrons/" . $guarantee->borrowernumber );
107
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
169
    $tx->req->cookies( { name => 'CGISESSID', value => $session_id } );
108
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
170
    $tx->req->env( { REMOTE_ADDR => $remote_address } );
109
171
110
    my $stash;
111
    $t->app->hook(after_dispatch => sub { $stash = shift->stash });
172
    $t->app->hook(after_dispatch => sub { $stash = shift->stash });
112
    $t->request_ok($tx)->status_is(200);
173
    $t->request_ok($tx)->status_is(200);
113
174
114
    my $user = $stash->{'koha.user'};
175
    $reason = $stash->{'grant_reason'};
115
    ok( defined $user, 'The \'koha.user\' object is defined in the stash') and
176
    is( $reason, 'permissions', "grant_reason is 'permissions'" );
116
    is( ref($user), 'Koha::Patron', 'Stashed koha.user object type is Koha::Patron') and
117
    is( $user->borrowernumber, $borrowernumber, 'The stashed user is the right one' );
118
177
119
    $schema->storage->txn_rollback;
178
    $schema->storage->txn_rollback;
120
};
179
};
Lines 124-133 sub create_user_and_session { Link Here
124
    my $args  = shift;
183
    my $args  = shift;
125
    my $flags = ( $args->{authorized} ) ? 16 : 0;
184
    my $flags = ( $args->{authorized} ) ? 16 : 0;
126
185
127
    my $user = $builder->build(
186
    my $patron = $builder->build_object(
128
        {
187
        {
129
            source => 'Borrower',
188
            class => 'Koha::Patrons',
130
            value  => {
189
            value => {
131
                flags => $flags
190
                flags => $flags
132
            }
191
            }
133
        }
192
        }
Lines 135-145 sub create_user_and_session { Link Here
135
194
136
    # Create a session for the authorized user
195
    # Create a session for the authorized user
137
    my $session = C4::Auth::get_session('');
196
    my $session = C4::Auth::get_session('');
138
    $session->param( 'number',   $user->{borrowernumber} );
197
    $session->param( 'number',   $patron->borrowernumber );
139
    $session->param( 'id',       $user->{userid} );
198
    $session->param( 'id',       $patron->userid );
140
    $session->param( 'ip',       '127.0.0.1' );
199
    $session->param( 'ip',       '127.0.0.1' );
141
    $session->param( 'lasttime', time() );
200
    $session->param( 'lasttime', time() );
142
    $session->flush;
201
    $session->flush;
143
202
144
    return ( $user->{borrowernumber}, $session->id );
203
    return ( $patron, $session->id );
145
}
204
}
146
- 

Return to bug 21198