Bug 25898: Prohibit indirect object notation
[koha.git] / t / db_dependent / api / v1 / items.t
bloba3ba781cf447b893258f4bd856e59c5ce2a760d7
1 #!/usr/bin/env perl
3 # Copyright 2016 Koha-Suomi
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 use Modern::Perl;
22 use Test::More tests => 2;
23 use Test::Mojo;
24 use Test::Warn;
26 use t::lib::TestBuilder;
27 use t::lib::Mocks;
29 use C4::Auth;
30 use Koha::Items;
31 use Koha::Database;
33 my $schema = Koha::Database->new->schema;
34 my $builder = t::lib::TestBuilder->new;
36 t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
38 my $t = Test::Mojo->new('Koha::REST::V1');
40 subtest 'list() tests' => sub {
42 plan tests => 12;
44 $schema->storage->txn_begin;
46 my $item = $builder->build_sample_item;
47 my $patron = $builder->build_object(
49 class => 'Koha::Patrons',
50 value => { flags => 4 }
54 # Make sure we have at least 10 items
55 for ( 1..10 ) {
56 $builder->build_sample_item;
59 my $nonprivilegedpatron = $builder->build_object(
61 class => 'Koha::Patrons',
62 value => { flags => 0 }
66 my $password = 'thePassword123';
68 $nonprivilegedpatron->set_password(
69 { password => $password, skip_validation => 1 } );
70 my $userid = $nonprivilegedpatron->userid;
72 $t->get_ok( "//$userid:$password@/api/v1/items" )
73 ->status_is(403)
74 ->json_is(
75 '/error' => 'Authorization failure. Missing required permission(s).' );
77 $patron->set_password( { password => $password, skip_validation => 1 } );
78 $userid = $patron->userid;
80 $t->get_ok( "//$userid:$password@/api/v1/items?_per_page=10" )
81 ->status_is( 200, 'SWAGGER3.2.2' );
83 my $response_count = scalar @{ $t->tx->res->json };
85 is( $response_count, 10, 'The API returns 10 items' );
87 $t->get_ok( "//$userid:$password@/api/v1/items?external_id=" . $item->barcode )
88 ->status_is(200)
89 ->json_is( '' => [ $item->to_api ], 'SWAGGER3.3.2');
91 my $barcode = $item->barcode;
92 $item->delete;
94 $t->get_ok( "//$userid:$password@/api/v1/items?external_id=" . $item->barcode )
95 ->status_is(200)
96 ->json_is( '' => [] );
98 $schema->storage->txn_rollback;
102 subtest 'get() tests' => sub {
104 plan tests => 9;
106 $schema->storage->txn_begin;
108 my $item = $builder->build_sample_item;
109 my $patron = $builder->build_object({
110 class => 'Koha::Patrons',
111 value => { flags => 4 }
114 my $nonprivilegedpatron = $builder->build_object({
115 class => 'Koha::Patrons',
116 value => { flags => 0 }
119 my $password = 'thePassword123';
121 $nonprivilegedpatron->set_password({ password => $password, skip_validation => 1 });
122 my $userid = $nonprivilegedpatron->userid;
124 $t->get_ok( "//$userid:$password@/api/v1/items/" . $item->itemnumber )
125 ->status_is(403)
126 ->json_is( '/error' => 'Authorization failure. Missing required permission(s).' );
128 $patron->set_password({ password => $password, skip_validation => 1 });
129 $userid = $patron->userid;
131 $t->get_ok( "//$userid:$password@/api/v1/items/" . $item->itemnumber )
132 ->status_is( 200, 'SWAGGER3.2.2' )
133 ->json_is( '' => $item->to_api, 'SWAGGER3.3.2' );
135 my $non_existent_code = $item->itemnumber;
136 $item->delete;
138 $t->get_ok( "//$userid:$password@/api/v1/items/" . $non_existent_code )
139 ->status_is(404)
140 ->json_is( '/error' => 'Item not found' );
142 $schema->storage->txn_rollback;