View | Details | Raw Unified | Return to bug 20006
Collapse All | Expand All

(-)a/t/db_dependent/api/v1/holds.t (-83 / +38 lines)
Lines 17-23 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 5;
20
use Test::More tests => 4;
21
use Test::Mojo;
21
use Test::Mojo;
22
use t::lib::TestBuilder;
22
use t::lib::TestBuilder;
23
use t::lib::Mocks;
23
use t::lib::Mocks;
Lines 149-167 my $reserve_id = C4::Reserves::AddReserve($branchcode, $patron_1->borrowernumber Link Here
149
my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $patron_2->borrowernumber,
149
my $reserve_id2 = C4::Reserves::AddReserve($branchcode, $patron_2->borrowernumber,
150
    $biblionumber, undef, 2, undef, undef, undef, '', $itemnumber);
150
    $biblionumber, undef, 2, undef, undef, undef, '', $itemnumber);
151
151
152
my $suspend_until = DateTime->now->add(days => 10)->ymd;
152
my $suspended_until = DateTime->now->add(days => 10)->truncate( to => 'day' );
153
my $expirationdate = DateTime->now->add(days => 10)->ymd;
153
my $expiration_date = DateTime->now->add(days => 10)->truncate( to => 'day' );
154
154
155
my $post_data = {
155
my $post_data = {
156
    borrowernumber => int($patron_1->borrowernumber),
156
    patron_id => int($patron_1->borrowernumber),
157
    biblionumber => int($biblionumber),
157
    biblio_id => int($biblionumber),
158
    itemnumber => int($itemnumber),
158
    item_id => int($itemnumber),
159
    branchcode => $branchcode,
159
    pickup_library_id => $branchcode,
160
    expirationdate => $expirationdate,
160
    expiration_date => output_pref({ dt => $expiration_date, dateformat => 'rfc3339', dateonly => 1 }),
161
    priority => 2,
161
};
162
};
162
my $put_data = {
163
my $put_data = {
163
    priority => 2,
164
    priority => 2,
164
    suspend_until => $suspend_until,
165
    suspended_until => output_pref({ dt => $suspended_until, dateformat => 'rfc3339' }),
165
};
166
};
166
167
167
subtest "Test endpoints without authentication" => sub {
168
subtest "Test endpoints without authentication" => sub {
Lines 180-190 subtest "Test endpoints without authentication" => sub { Link Here
180
subtest "Test endpoints without permission" => sub {
181
subtest "Test endpoints without permission" => sub {
181
    plan tests => 10;
182
    plan tests => 10;
182
183
183
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
184
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
184
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
185
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
185
    $t->request_ok($tx) # no permission
186
    $t->request_ok($tx) # no permission
186
      ->status_is(403);
187
      ->status_is(403);
187
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
188
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
188
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
189
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
189
    $t->request_ok($tx) # reserveforothers permission
190
    $t->request_ok($tx) # reserveforothers permission
190
      ->status_is(403);
191
      ->status_is(403);
Lines 201-247 subtest "Test endpoints without permission" => sub { Link Here
201
    $t->request_ok($tx) # no permission
202
    $t->request_ok($tx) # no permission
202
      ->status_is(403);
203
      ->status_is(403);
203
};
204
};
204
subtest "Test endpoints without permission, but accessing own object" => sub {
205
    plan tests => 16;
206
207
    my $borrno_tmp = $post_data->{'borrowernumber'};
208
    $post_data->{'borrowernumber'} = int $nopermission->{'borrowernumber'};
209
    $tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data);
210
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
211
    $t->request_ok($tx) # create hold to myself
212
      ->status_is(201)
213
      ->json_has('/reserve_id');
214
215
    $post_data->{'borrowernumber'} = $borrno_tmp;
216
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=".$nopermission-> { borrowernumber });
217
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
218
    $t->request_ok($tx) # get my own holds
219
      ->status_is(200)
220
      ->json_is('/0/borrowernumber', $nopermission->{ borrowernumber })
221
      ->json_is('/0/biblionumber', $biblionumber)
222
      ->json_is('/0/itemnumber', $itemnumber)
223
      ->json_is('/0/expirationdate', $expirationdate)
224
      ->json_is('/0/branchcode', $branchcode);
225
226
    my $reserve_id3 = Koha::Holds->find({ borrowernumber => $nopermission->{borrowernumber} })->reserve_id;
227
    $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id3" => json => $put_data);
228
    $tx->req->cookies({name => 'CGISESSID', value => $session_nopermission->id});
229
    $t->request_ok($tx)    # create hold to myself
230
      ->status_is(200)->json_is( '/reserve_id', $reserve_id3 )->json_is(
231
        '/suspend_until',
232
        output_pref(
233
            {
234
                dateformat => 'rfc3339',
235
                dt => dt_from_string( $suspend_until . ' 00:00:00', 'sql' )
236
            }
237
        )
238
      )
239
      ->json_is( '/priority',   2 )
240
      ->json_is( '/itemnumber', $itemnumber );
241
};
242
205
243
subtest "Test endpoints with permission" => sub {
206
subtest "Test endpoints with permission" => sub {
244
    plan tests => 45;
207
208
    plan tests => 44;
245
209
246
    $tx = $t->ua->build_tx(GET => '/api/v1/holds');
210
    $tx = $t->ua->build_tx(GET => '/api/v1/holds');
247
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
211
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
Lines 249-276 subtest "Test endpoints with permission" => sub { Link Here
249
      ->status_is(200)
213
      ->status_is(200)
250
      ->json_has('/0')
214
      ->json_has('/0')
251
      ->json_has('/1')
215
      ->json_has('/1')
252
      ->json_has('/2')
216
      ->json_hasnt('/2');
253
      ->json_hasnt('/3');
254
217
255
    $tx = $t->ua->build_tx(GET => '/api/v1/holds?priority=2');
218
    $tx = $t->ua->build_tx(GET => '/api/v1/holds?priority=2');
256
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
219
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
257
    $t->request_ok($tx)
220
    $t->request_ok($tx)
258
      ->status_is(200)
221
      ->status_is(200)
259
      ->json_is('/0/borrowernumber', $nopermission->{borrowernumber})
222
      ->json_is('/0/patron_id', $patron_2->borrowernumber)
260
      ->json_hasnt('/1');
223
      ->json_hasnt('/1');
261
224
262
    $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id" => json => $put_data);
225
    $tx = $t->ua->build_tx(PUT => "/api/v1/holds/$reserve_id" => json => $put_data);
263
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
226
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
264
    $t->request_ok($tx)->status_is(200)->json_is( '/reserve_id', $reserve_id )
227
    $t->request_ok($tx)
265
      ->json_is(
228
      ->status_is(200)
266
        '/suspend_until',
229
      ->json_is( '/hold_id', $reserve_id )
267
        output_pref(
230
      ->json_is( '/suspended_until', output_pref({ dt => $suspended_until, dateformat => 'rfc3339' }) )
268
            {
269
                dateformat => 'rfc3339',
270
                dt => dt_from_string( $suspend_until . ' 00:00:00', 'sql' )
271
            }
272
        )
273
      )
274
      ->json_is( '/priority', 2 );
231
      ->json_is( '/priority', 2 );
275
232
276
    $tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id");
233
    $tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id");
Lines 290-303 subtest "Test endpoints with permission" => sub { Link Here
290
      ->status_is(404)
247
      ->status_is(404)
291
      ->json_has('/error');
248
      ->json_has('/error');
292
249
293
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
250
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
294
    $tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag
251
    $tx->req->cookies({name => 'CGISESSID', value => $session2->id}); # get with borrowers flag
295
    $t->request_ok($tx)
252
    $t->request_ok($tx)
296
      ->status_is(200)
253
      ->status_is(200)
297
      ->json_is([]);
254
      ->json_is([]);
298
255
299
    my $inexisting_borrowernumber = $patron_2->borrowernumber * 2;
256
    my $inexisting_borrowernumber = $patron_2->borrowernumber * 2;
300
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=$inexisting_borrowernumber");
257
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=$inexisting_borrowernumber");
301
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
258
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
302
    $t->request_ok($tx)
259
    $t->request_ok($tx)
303
      ->status_is(200)
260
      ->status_is(200)
Lines 312-327 subtest "Test endpoints with permission" => sub { Link Here
312
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
269
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
313
    $t->request_ok($tx)
270
    $t->request_ok($tx)
314
      ->status_is(201)
271
      ->status_is(201)
315
      ->json_has('/reserve_id');
272
      ->json_has('/hold_id');
316
    $reserve_id = $t->tx->res->json->{reserve_id};
273
    $reserve_id = $t->tx->res->json->{hold_id};
317
274
318
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
275
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
319
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
276
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
320
    $t->request_ok($tx)
277
    $t->request_ok($tx)
321
      ->status_is(200)
278
      ->status_is(200)
322
      ->json_is('/0/reserve_id', $reserve_id)
279
      ->json_is('/0/hold_id', $reserve_id)
323
      ->json_is('/0/expirationdate', $expirationdate)
280
      ->json_is('/0/expiration_date', output_pref({ dt => $expiration_date, dateformat => 'rfc3339', dateonly => 1 }))
324
      ->json_is('/0/branchcode', $branchcode);
281
      ->json_is('/0/pickup_library_id', $branchcode);
325
282
326
    $tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data);
283
    $tx = $t->ua->build_tx(POST => "/api/v1/holds" => json => $post_data);
327
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
284
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
Lines 335-352 subtest "Test endpoints with permission" => sub { Link Here
335
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
292
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
336
    $t->request_ok($tx)
293
    $t->request_ok($tx)
337
      ->status_is(403)
294
      ->status_is(403)
338
      ->json_like('/error', qr/tooManyReserves/);
295
      ->json_like('/error', qr/itemAlreadyOnHold/);
339
};
296
};
340
297
341
342
subtest 'Reserves with itemtype' => sub {
298
subtest 'Reserves with itemtype' => sub {
343
    plan tests => 9;
299
    plan tests => 9;
344
300
345
    my $post_data = {
301
    my $post_data = {
346
        borrowernumber => int($patron_1->borrowernumber),
302
        patron_id => int($patron_1->borrowernumber),
347
        biblionumber => int($biblionumber),
303
        biblio_id => int($biblionumber),
348
        branchcode => $branchcode,
304
        pickup_library_id => $branchcode,
349
        itemtype => $itemtype,
305
        item_type => $itemtype,
350
    };
306
    };
351
307
352
    $tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id");
308
    $tx = $t->ua->build_tx(DELETE => "/api/v1/holds/$reserve_id");
Lines 358-373 subtest 'Reserves with itemtype' => sub { Link Here
358
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
314
    $tx->req->cookies({name => 'CGISESSID', value => $session3->id});
359
    $t->request_ok($tx)
315
    $t->request_ok($tx)
360
      ->status_is(201)
316
      ->status_is(201)
361
      ->json_has('/reserve_id');
317
      ->json_has('/hold_id');
362
318
363
    $reserve_id = $t->tx->res->json->{reserve_id};
319
    $reserve_id = $t->tx->res->json->{hold_id};
364
320
365
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?borrowernumber=" . $patron_1->borrowernumber);
321
    $tx = $t->ua->build_tx(GET => "/api/v1/holds?patron_id=" . $patron_1->borrowernumber);
366
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
322
    $tx->req->cookies({name => 'CGISESSID', value => $session->id});
367
    $t->request_ok($tx)
323
    $t->request_ok($tx)
368
      ->status_is(200)
324
      ->status_is(200)
369
      ->json_is('/0/reserve_id', $reserve_id)
325
      ->json_is('/0/hold_id', $reserve_id)
370
      ->json_is('/0/itemtype', $itemtype);
326
      ->json_is('/0/item_type', $itemtype);
371
};
327
};
372
328
373
$schema->storage->txn_rollback;
329
$schema->storage->txn_rollback;
374
- 

Return to bug 20006