Bug 30979 implemented an endpoint for checking availability for checking out an item, and the description explains it is for checking out themselves... but it allows asking for any patron's checkoutability. I open this bug to discuss that behvior.
I assume this is a public route? It does sound not quite right. Not sure what is returned, but could others learn about restrictions etc.?
Good catch.. I'm not sure I thought about that case.. there is already the staff version of this api endpoint for third party consumers so I think your right.. the public endpoint should be more locked down.
Created attachment 155544 [details] [review] Bug 34287: Add check on public availability endpoint A quick check for patron equals current user in the public availability endpoint.
Seems like a good fix except that unit tests seem to be failing now for t/db_dependent/api/v1/checkouts.t
Created attachment 155929 [details] [review] Bug 34287: Amend unit test This patch updates the unit test to confirm that checkout availability should be restricted to the patron checking the availability options on the public side.
Created attachment 155930 [details] [review] Bug 34287: Add check on public availability endpoint A quick check for patron equals current user in the public availability endpoint.
Reworked and unit tested
Hum, I am confused, didn't we have a test to ensure that all our routes had the "x-koha-authorization" entry?
Created attachment 158043 [details] [review] Bug 34287: Amend unit test This patch updates the unit test to confirm that checkout availability should be restricted to the patron checking the availability options on the public side. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 158044 [details] [review] Bug 34287: Add check on public availability endpoint A quick check for patron equals current user in the public availability endpoint. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 158251 [details] [review] Bug 34287: Amend unit test This patch updates the unit test to confirm that checkout availability should be restricted to the patron checking the availability options on the public side. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 158252 [details] [review] Bug 34287: Add check on public availability endpoint A quick check for patron equals current user in the public availability endpoint. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Pushed to master for 23.11. Nice work everyone, thanks!
Depends on Bug 30979 not in 23.05.x