Bug 17565

Summary: REST API: Let user cancel reserve according to CanReserveBeCanceledFromOpac
Product: Koha Reporter: Lari Taskula <lari.taskula>
Component: REST APIAssignee: Lari Taskula <lari.taskula>
Status: BLOCKED --- QA Contact:
Severity: enhancement    
Priority: P5 - low CC: jonathan.druart, m.de.rooy
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 17479, 17431    
Bug Blocks:    
Attachments: Bug 17565: REST API: Let user cancel reserve according to CanReserveBeCanceledFromOpac
[SIGNED-OFF] Bug 17565: REST API: Let user cancel reserve according to CanReserveBeCanceledFromOpac

Description Lari Taskula 2016-11-07 12:36:55 UTC
Currently REST API does not allow hold cancellation for an OPAC user. Only users with reserveforothers have ability to make cancellations.

Let user cancel reserve according to CanReserveBeCanceledFromOpac
Comment 1 Lari Taskula 2016-11-07 14:50:06 UTC
Created attachment 57264 [details] [review]
Bug 17565: REST API: Let user cancel reserve according to CanReserveBeCanceledFromOpac

This patch adds ability for patron to cancel their own holds.

To test:
1. Make sure you have patches from dependant bugs.
2. Apply this patch.
3. Place a hold for a patron that has no permissions.
4. Set hold to Waiting or Transfer status (found => 'W' or 'T' in database).
5. Login with that patron (and get their CGISESSID for cURL).
6. Test DELETE operation for the reserve_id that you just created, e.g.
   with cURL:

   curl -X DELETE -H "Content-Type: application/json" \
   --cookie 'CGISESSID=0230cb985c4fb5844f71ba41f76a0ced' \
   http://yourlib/api/v1/holds/4621
7. Observe HTTP 403 code and following error message:
   "Hold is already in transfer or waiting and cannot be cancelled by patron."
8. Reset hold's "found"-status in database.
9. Run the same cURL command as in step 6.
10. Observe HTTP 200 code and empty object as return.
11. Test DELETE operation for any other reserve_id, e.g. with cURL

   curl -X DELETE -H "Content-Type: application/json" \
   --cookie 'CGISESSID=0230cb985c4fb5844f71ba41f76a0ced' \
   http://yourlib/api/v1/holds/123
12. Observe permission required error.
13. Run t/db_dependent/api/v1/holds.t
Comment 2 Josef Moravec 2017-01-17 20:08:36 UTC
Created attachment 59098 [details] [review]
[SIGNED-OFF] Bug 17565: REST API: Let user cancel reserve according to CanReserveBeCanceledFromOpac

This patch adds ability for patron to cancel their own holds.

To test:
1. Make sure you have patches from dependant bugs.
2. Apply this patch.
3. Place a hold for a patron that has no permissions.
4. Set hold to Waiting or Transfer status (found => 'W' or 'T' in database).
5. Login with that patron (and get their CGISESSID for cURL).
6. Test DELETE operation for the reserve_id that you just created, e.g.
   with cURL:

   curl -X DELETE -H "Content-Type: application/json" \
   --cookie 'CGISESSID=0230cb985c4fb5844f71ba41f76a0ced' \
   http://yourlib/api/v1/holds/4621
7. Observe HTTP 403 code and following error message:
   "Hold is already in transfer or waiting and cannot be cancelled by patron."
8. Reset hold's "found"-status in database.
9. Run the same cURL command as in step 6.
10. Observe HTTP 200 code and empty object as return.
11. Test DELETE operation for any other reserve_id, e.g. with cURL

   curl -X DELETE -H "Content-Type: application/json" \
   --cookie 'CGISESSID=0230cb985c4fb5844f71ba41f76a0ced' \
   http://yourlib/api/v1/holds/123
12. Observe permission required error.
13. Run t/db_dependent/api/v1/holds.t

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 3 Marcel de Rooy 2017-06-16 08:32:54 UTC
Depends on a bug in FQA