View | Details | Raw Unified | Return to bug 23146
Collapse All | Expand All

(-)a/t/db_dependent/api/v1/oauth.t (-58 / +113 lines)
Lines 21-26 use Test::More; Link Here
21
use Test::MockModule;
21
use Test::MockModule;
22
use Test::Mojo;
22
use Test::Mojo;
23
23
24
use MIME::Base64;
24
use Module::Load::Conditional qw(can_load);
25
use Module::Load::Conditional qw(can_load);
25
26
26
use Koha::ApiKeys;
27
use Koha::ApiKeys;
Lines 43-58 else { Link Here
43
44
44
subtest '/oauth/token tests' => sub {
45
subtest '/oauth/token tests' => sub {
45
46
46
    plan tests => 27;
47
    plan tests => 10;
47
48
    $schema->storage->txn_begin;
49
48
50
    my $patron = $builder->build_object({
49
    t::lib::Mocks::mock_preference('RESTOAuth2ClientCredentials', 0);
51
        class => 'Koha::Patrons',
52
        value  => {
53
            flags => 0 # no permissions
54
        },
55
    });
56
50
57
    # Missing parameter grant_type
51
    # Missing parameter grant_type
58
    $t->post_ok('/api/v1/oauth/token')
52
    $t->post_ok('/api/v1/oauth/token')
Lines 70-129 subtest '/oauth/token tests' => sub { Link Here
70
        ->status_is(403)
64
        ->status_is(403)
71
        ->json_is({error => 'unauthorized_client'});
65
        ->json_is({error => 'unauthorized_client'});
72
66
73
    my $api_key = Koha::ApiKey->new({ patron_id => $patron->id, description => 'blah' })->store;
67
    subtest 'Client credentials in body' => sub {
74
68
75
    my $formData = {
69
        plan tests => 19;
76
        grant_type    => 'client_credentials',
77
        client_id     => $api_key->client_id,
78
        client_secret => $api_key->secret
79
    };
80
    $t->post_ok('/api/v1/oauth/token', form => $formData)
81
        ->status_is(200)
82
        ->json_is('/expires_in' => 3600)
83
        ->json_is('/token_type' => 'Bearer')
84
        ->json_has('/access_token');
85
86
    my $access_token = $t->tx->res->json->{access_token};
87
88
    # Without access token, it returns 401
89
    $t->get_ok('/api/v1/patrons')->status_is(401);
90
91
    # With access token, but without permissions, it returns 403
92
    my $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
93
    $tx->req->headers->authorization("Bearer $access_token");
94
    $t->request_ok($tx)->status_is(403);
95
96
    # With access token and permissions, it returns 200
97
    $patron->flags(2**4)->store;
98
    $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
99
    $tx->req->headers->authorization("Bearer $access_token");
100
    $t->request_ok($tx)->status_is(200);
101
70
102
    # expire token
71
        run_oauth_tests( 'body' );
103
    my $token = Koha::OAuthAccessTokens->find($access_token);
72
    };
104
    $token->expires( time - 1 )->store;
105
    $tx = $t->ua->build_tx( GET => '/api/v1/patrons' );
106
    $tx->req->headers->authorization("Bearer $access_token");
107
    $t->request_ok($tx)
108
      ->status_is(401);
109
73
110
    # revoke key
74
    subtest 'Client credentials in Authorization header' => sub {
111
    $api_key->active(0)->store;
112
    $t->post_ok('/api/v1/oauth/token', form => $formData)
113
        ->status_is(403)
114
        ->json_is({ error => 'unauthorized_client' });
115
75
116
    # disable client credentials grant
117
    t::lib::Mocks::mock_preference('RESTOAuth2ClientCredentials', 0);
118
76
119
    # enable API key
77
        plan tests => 19;
120
    $api_key->active(1)->store;
121
    # Wrong grant type
122
    $t->post_ok('/api/v1/oauth/token', form => $formData )
123
        ->status_is(400)
124
        ->json_is({ error => 'Unimplemented grant type' });
125
78
126
    $schema->storage->txn_rollback;
79
        run_oauth_tests( 'header' );
80
    };
127
};
81
};
128
82
129
subtest 'Net::OAuth2::AuthorizationServer missing tests' => sub {
83
subtest 'Net::OAuth2::AuthorizationServer missing tests' => sub {
Lines 162-164 subtest 'Net::OAuth2::AuthorizationServer missing tests' => sub { Link Here
162
      ->json_is( { error => 'Unimplemented grant type' } );
116
      ->json_is( { error => 'Unimplemented grant type' } );
163
117
164
};
118
};
165
- 
119
120
sub run_oauth_tests {
121
    my ( $test_case ) = @_;
122
123
    $schema->storage->txn_begin;
124
125
    my $patron = $builder->build_object({
126
        class => 'Koha::Patrons',
127
        value  => {
128
            flags => 0 # no permissions
129
        },
130
    });
131
132
    my $api_key = Koha::ApiKey->new({ patron_id => $patron->id, description => 'blah' })->store;
133
134
    t::lib::Mocks::mock_preference( 'RESTOAuth2ClientCredentials', 1 );
135
136
    my $formData;
137
    my $client_id     = $api_key->client_id;
138
    my $client_secret = $api_key->secret;
139
140
    if ( $test_case eq 'header' ) {
141
142
        $formData = { grant_type => 'client_credentials' };
143
144
        $t->post_ok("//$client_id:$client_secret@/api/v1/oauth/token", form => $formData)
145
          ->status_is(200)
146
          ->json_is('/expires_in' => 3600)
147
          ->json_is('/token_type' => 'Bearer')
148
          ->json_has('/access_token');
149
    } else {
150
151
        $formData = {
152
            grant_type    => 'client_credentials',
153
            client_id     => $api_key->client_id,
154
            client_secret => $api_key->secret
155
        };
156
157
        $t->post_ok('/api/v1/oauth/token', form => $formData)
158
          ->status_is(200)
159
          ->json_is('/expires_in' => 3600)
160
          ->json_is('/token_type' => 'Bearer')
161
          ->json_has('/access_token');
162
    }
163
164
    my $access_token = $t->tx->res->json->{access_token};
165
166
    # Without access token, it returns 401
167
    $t->get_ok('/api/v1/patrons')->status_is(401);
168
169
    # With access token, but without permissions, it returns 403
170
    my $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
171
    $tx->req->headers->authorization("Bearer $access_token");
172
    $t->request_ok($tx)->status_is(403);
173
174
    # With access token and permissions, it returns 200
175
    $patron->flags(2**4)->store;
176
    $tx = $t->ua->build_tx(GET => '/api/v1/patrons');
177
    $tx->req->headers->authorization("Bearer $access_token");
178
    $t->request_ok($tx)->status_is(200);
179
180
    # expire token
181
    my $token = Koha::OAuthAccessTokens->find($access_token);
182
    $token->expires( time - 1 )->store;
183
    $tx = $t->ua->build_tx( GET => '/api/v1/patrons' );
184
    $tx->req->headers->authorization("Bearer $access_token");
185
    $t->request_ok($tx)
186
      ->status_is(401);
187
188
    # revoke key
189
    $api_key->active(0)->store;
190
191
    if ( $test_case eq 'header' ) {
192
        $t->post_ok("//$client_id:$client_secret@/api/v1/oauth/token", form => $formData)
193
          ->status_is(403)
194
          ->json_is({ error => 'unauthorized_client' });
195
    } else {
196
        $t->post_ok('/api/v1/oauth/token', form => $formData)
197
          ->status_is(403)
198
          ->json_is({ error => 'unauthorized_client' });
199
    }
200
201
    # disable client credentials grant
202
   t::lib::Mocks::mock_preference('RESTOAuth2ClientCredentials', 0);
203
204
    # enable API key
205
    $api_key->active(1)->store;
206
207
    # Wrong grant type
208
    if ( $test_case eq 'header' ) {
209
        $t->post_ok("//$client_id:$client_secret@/api/v1/oauth/token", form => $formData )
210
          ->status_is(400)
211
          ->json_is({ error => 'Unimplemented grant type' });
212
    }
213
    else {
214
        $t->post_ok('/api/v1/oauth/token', form => $formData )
215
          ->status_is(400)
216
          ->json_is({ error => 'Unimplemented grant type' });
217
    }
218
219
    $schema->storage->txn_rollback;
220
}

Return to bug 23146