Bug 25898: Prohibit indirect object notation
[koha.git] / t / db_dependent / api / v1 / checkouts.t
blobee47e1ef4751761f19c3fe8e80a7881c66b9c454
1 #!/usr/bin/env perl
3 # This file is part of Koha.
5 # Koha is free software; you can redistribute it and/or modify it
6 # under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
10 # Koha is distributed in the hope that it will be useful, but
11 # WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with Koha; if not, see <http://www.gnu.org/licenses>.
18 use Modern::Perl;
20 use Test::More tests => 93;
21 use Test::MockModule;
22 use Test::Mojo;
23 use t::lib::Mocks;
24 use t::lib::TestBuilder;
26 use DateTime;
28 use C4::Context;
29 use C4::Circulation;
31 use Koha::Database;
32 use Koha::DateUtils;
34 my $schema = Koha::Database->schema;
35 my $builder = t::lib::TestBuilder->new;
37 t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
38 my $t = Test::Mojo->new('Koha::REST::V1');
40 $schema->storage->txn_begin;
42 my $dbh = C4::Context->dbh;
44 my $librarian = $builder->build_object({
45 class => 'Koha::Patrons',
46 value => { flags => 2 }
47 });
48 my $password = 'thePassword123';
49 $librarian->set_password({ password => $password, skip_validation => 1 });
50 my $userid = $librarian->userid;
52 my $patron = $builder->build_object({
53 class => 'Koha::Patrons',
54 value => { flags => 0 }
55 });
56 my $unauth_password = 'thePassword000';
57 $patron->set_password({ password => $unauth_password, skip_validattion => 1 });
58 my $unauth_userid = $patron->userid;
59 my $patron_id = $patron->borrowernumber;
61 my $branchcode = $builder->build({ source => 'Branch' })->{ branchcode };
62 my $module = Test::MockModule->new('C4::Context');
63 $module->mock('userenv', sub { { branch => $branchcode } });
65 $t->get_ok( "//$userid:$password@/api/v1/checkouts?patron_id=$patron_id" )
66 ->status_is(200)
67 ->json_is([]);
69 my $notexisting_patron_id = $patron_id + 1;
70 $t->get_ok( "//$userid:$password@/api/v1/checkouts?patron_id=$notexisting_patron_id" )
71 ->status_is(200)
72 ->json_is([]);
74 Koha::CirculationRules->set_rules(
76 categorycode => undef,
77 itemtype => undef,
78 branchcode => undef,
79 rules => {
80 renewalperiod => 7,
81 renewalsallowed => 1,
82 issuelength => 5,
87 my $item1 = $builder->build_sample_item;
88 my $item2 = $builder->build_sample_item;
89 my $item3 = $builder->build_sample_item;
90 my $item4 = $builder->build_sample_item;
92 my $date_due = DateTime->now->add(weeks => 2);
93 my $issue1 = C4::Circulation::AddIssue($patron->unblessed, $item1->barcode, $date_due);
94 my $date_due1 = Koha::DateUtils::dt_from_string( $issue1->date_due );
95 my $issue2 = C4::Circulation::AddIssue($patron->unblessed, $item2->barcode, $date_due);
96 my $date_due2 = Koha::DateUtils::dt_from_string( $issue2->date_due );
97 my $issue3 = C4::Circulation::AddIssue($librarian->unblessed, $item3->barcode, $date_due);
98 my $date_due3 = Koha::DateUtils::dt_from_string( $issue3->date_due );
99 my $issue4 = C4::Circulation::AddIssue($patron->unblessed, $item4->barcode);
100 C4::Circulation::AddReturn($item4->barcode, $branchcode);
102 $t->get_ok( "//$userid:$password@/api/v1/checkouts?patron_id=$patron_id" )
103 ->status_is(200)
104 ->json_is('/0/patron_id' => $patron_id)
105 ->json_is('/0/item_id' => $item1->itemnumber)
106 ->json_is('/0/due_date' => output_pref({ dateformat => "rfc3339", dt => $date_due1 }) )
107 ->json_is('/1/patron_id' => $patron_id)
108 ->json_is('/1/item_id' => $item2->itemnumber)
109 ->json_is('/1/due_date' => output_pref({ dateformat => "rfc3339", dt => $date_due2 }) )
110 ->json_hasnt('/2');
112 # Test checked_in parameter, zero means, the response is same as without it
113 $t->get_ok( "//$userid:$password@/api/v1/checkouts?patron_id=$patron_id&checked_in=0" )
114 ->status_is(200)
115 ->json_is('/0/patron_id' => $patron_id)
116 ->json_is('/0/item_id' => $item1->itemnumber)
117 ->json_is('/0/due_date' => output_pref({ dateformat => "rfc3339", dt => $date_due1 }) )
118 ->json_is('/1/patron_id' => $patron_id)
119 ->json_is('/1/item_id' => $item2->itemnumber)
120 ->json_is('/1/due_date' => output_pref({ dateformat => "rfc3339", dt => $date_due2 }) )
121 ->json_hasnt('/2');
123 # Test checked_in parameter, one measn, the checked in checkout is in the response too
124 $t->get_ok( "//$userid:$password@/api/v1/checkouts?patron_id=$patron_id&checked_in=1" )
125 ->status_is(200)
126 ->json_is('/0/patron_id' => $patron_id)
127 ->json_is('/0/item_id' => $item4->itemnumber)
128 ->json_hasnt('/1');
130 $t->get_ok( "//$unauth_userid:$unauth_password@/api/v1/checkouts/" . $issue3->issue_id )
131 ->status_is(403)
132 ->json_is({ error => "Authorization failure. Missing required permission(s).",
133 required_permissions => { circulate => "circulate_remaining_permissions" }
136 $t->get_ok( "//$userid:$password@/api/v1/checkouts?patron_id=$patron_id")
137 ->status_is(200)
138 ->json_is('/0/patron_id' => $patron_id)
139 ->json_is('/0/item_id' => $item1->itemnumber)
140 ->json_is('/0/due_date' => output_pref({ dateformat => "rfc3339", dt => $date_due1 }) )
141 ->json_is('/1/patron_id' => $patron_id)
142 ->json_is('/1/item_id' => $item2->itemnumber)
143 ->json_is('/1/due_date' => output_pref({ dateformat => "rfc3339", dt => $date_due2 }) )
144 ->json_hasnt('/2');
146 $t->get_ok( "//$userid:$password@/api/v1/checkouts?patron_id=$patron_id&_per_page=1&_page=1")
147 ->status_is(200)
148 ->header_is('X-Total-Count', '2')
149 ->header_like('Link', qr|rel="next"|)
150 ->header_like('Link', qr|rel="first"|)
151 ->header_like('Link', qr|rel="last"|)
152 ->json_is('/0/patron_id' => $patron_id)
153 ->json_is('/0/item_id' => $item1->itemnumber)
154 ->json_is('/0/due_date' => output_pref({ dateformat => "rfc3339", dt => $date_due1 }) )
155 ->json_hasnt('/1');
157 $t->get_ok( "//$userid:$password@/api/v1/checkouts?patron_id=$patron_id&_per_page=1&_page=2")
158 ->status_is(200)
159 ->header_is('X-Total-Count', '2')
160 ->header_like('Link', qr|rel="prev"|)
161 ->header_like('Link', qr|rel="first"|)
162 ->header_like('Link', qr|rel="last"|)
163 ->json_is('/0/patron_id' => $patron_id)
164 ->json_is('/0/item_id' => $item2->itemnumber)
165 ->json_is('/0/due_date' => output_pref({ dateformat => "rfc3339", dt => $date_due2 }) )
166 ->json_hasnt('/1');
168 $t->get_ok( "//$userid:$password@/api/v1/checkouts/" . $issue1->issue_id)
169 ->status_is(200)
170 ->json_is('/patron_id' => $patron_id)
171 ->json_is('/item_id' => $item1->itemnumber)
172 ->json_is('/due_date' => output_pref({ dateformat => "rfc3339", dt => $date_due1 }) )
173 ->json_hasnt('/1');
175 $t->get_ok( "//$userid:$password@/api/v1/checkouts/" . $issue1->issue_id)
176 ->status_is(200)
177 ->json_is('/due_date' => output_pref({ dateformat => "rfc3339", dt => $date_due1 }) );
179 $t->get_ok( "//$userid:$password@/api/v1/checkouts/" . $issue2->issue_id)
180 ->status_is(200)
181 ->json_is('/due_date' => output_pref( { dateformat => "rfc3339", dt => $date_due2 }) );
183 my $expected_datedue = $date_due
184 ->set_time_zone('local')
185 ->add(days => 7)
186 ->set(hour => 23, minute => 59, second => 0);
187 $t->post_ok ( "//$userid:$password@/api/v1/checkouts/" . $issue1->issue_id . "/renewal" )
188 ->status_is(201)
189 ->json_is('/due_date' => output_pref( { dateformat => "rfc3339", dt => $expected_datedue }) )
190 ->header_is(Location => "/api/v1/checkouts/" . $issue1->issue_id . "/renewal");
192 $t->post_ok( "//$unauth_userid:$unauth_password@/api/v1/checkouts/" . $issue3->issue_id . "/renewal" )
193 ->status_is(403)
194 ->json_is({ error => "Authorization failure. Missing required permission(s).",
195 required_permissions => { circulate => "circulate_remaining_permissions" }
198 $t->get_ok( "//$userid:$password@/api/v1/checkouts/" . $issue2->issue_id . "/allows_renewal")
199 ->status_is(200)
200 ->json_is({
201 allows_renewal => Mojo::JSON->true,
202 max_renewals => 1,
203 current_renewals => 0,
204 error => undef
207 $t->post_ok( "//$userid:$password@/api/v1/checkouts/" . $issue2->issue_id . "/renewal" )
208 ->status_is(201)
209 ->json_is('/due_date' => output_pref({ dateformat => "rfc3339", dt => $expected_datedue}) )
210 ->header_is(Location => "/api/v1/checkouts/" . $issue2->issue_id . "/renewal");
213 $t->post_ok( "//$userid:$password@/api/v1/checkouts/" . $issue1->issue_id . "/renewal" )
214 ->status_is(403)
215 ->json_is({ error => 'Renewal not authorized (too_many)' });
217 $t->get_ok( "//$userid:$password@/api/v1/checkouts/" . $issue2->issue_id . "/allows_renewal")
218 ->status_is(200)
219 ->json_is({
220 allows_renewal => Mojo::JSON->false,
221 max_renewals => 1,
222 current_renewals => 1,
223 error => 'too_many'