Bug 25898: Prohibit indirect object notation
[koha.git] / t / db_dependent / api / v1 / smtp_servers.t
blob79c6d59aa26a3b36ca2b752649467d792af899ec
1 #!/usr/bin/env perl
3 # This file is part of Koha.
5 # Koha is free software; you can redistribute it and/or modify it
6 # under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
10 # Koha is distributed in the hope that it will be useful, but
11 # WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with Koha; if not, see <http://www.gnu.org/licenses>.
18 use Modern::Perl;
20 use Test::More tests => 5;
21 use Test::Mojo;
23 use t::lib::TestBuilder;
24 use t::lib::Mocks;
26 use Koha::SMTP::Servers;
27 use Koha::Database;
29 my $schema = Koha::Database->new->schema;
30 my $builder = t::lib::TestBuilder->new;
32 my $t = Test::Mojo->new('Koha::REST::V1');
33 t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 );
35 subtest 'list() tests' => sub {
37 plan tests => 11;
39 $schema->storage->txn_begin;
41 Koha::SMTP::Servers->search->delete;
43 my $librarian = $builder->build_object(
45 class => 'Koha::Patrons',
46 value => { flags => 3**2 } # parameters flag = 3
49 my $password = 'thePassword123';
50 $librarian->set_password( { password => $password, skip_validation => 1 } );
51 my $userid = $librarian->userid;
53 my $patron = $builder->build_object(
55 class => 'Koha::Patrons',
56 value => { flags => 0 }
60 $patron->set_password( { password => $password, skip_validation => 1 } );
61 my $unauth_userid = $patron->userid;
63 ## Authorized user tests
64 # No SMTP servers, so empty array should be returned
65 $t->get_ok("//$userid:$password@/api/v1/config/smtp_servers")
66 ->status_is(200)->json_is( [] );
68 my $smtp_server =
69 $builder->build_object( { class => 'Koha::SMTP::Servers' } );
71 # One city created, should get returned
72 $t->get_ok("//$userid:$password@/api/v1/config/smtp_servers")
73 ->status_is(200)->json_is( [ $smtp_server->to_api ] );
75 my $another_smtp_server =
76 $builder->build_object( { class => 'Koha::SMTP::Servers' } );
78 # Two SMTP servers created, they should both be returned
79 $t->get_ok("//$userid:$password@/api/v1/config/smtp_servers")
80 ->status_is(200)
81 ->json_is( [ $smtp_server->to_api, $another_smtp_server->to_api, ] );
83 # Unauthorized access
84 $t->get_ok("//$unauth_userid:$password@/api/v1/config/smtp_servers")
85 ->status_is(403);
87 $schema->storage->txn_rollback;
90 subtest 'get() tests' => sub {
92 plan tests => 8;
94 $schema->storage->txn_begin;
96 my $smtp_server =
97 $builder->build_object( { class => 'Koha::SMTP::Servers' } );
98 my $librarian = $builder->build_object(
100 class => 'Koha::Patrons',
101 value => { flags => 3**2 } # parameters flag = 3
104 my $password = 'thePassword123';
105 $librarian->set_password( { password => $password, skip_validation => 1 } );
106 my $userid = $librarian->userid;
108 my $patron = $builder->build_object(
110 class => 'Koha::Patrons',
111 value => { flags => 0 }
115 $patron->set_password( { password => $password, skip_validation => 1 } );
116 my $unauth_userid = $patron->userid;
118 $t->get_ok(
119 "//$userid:$password@/api/v1/config/smtp_servers/" . $smtp_server->id )
120 ->status_is(200)->json_is( $smtp_server->to_api );
122 $t->get_ok( "//$unauth_userid:$password@/api/v1/config/smtp_servers/"
123 . $smtp_server->id )->status_is(403);
125 my $smtp_server_to_delete =
126 $builder->build_object( { class => 'Koha::SMTP::Servers' } );
127 my $non_existent_id = $smtp_server_to_delete->id;
128 $smtp_server_to_delete->delete;
130 $t->get_ok(
131 "//$userid:$password@/api/v1/config/smtp_servers/$non_existent_id")
132 ->status_is(404)->json_is( '/error' => 'SMTP server not found' );
134 $schema->storage->txn_rollback;
137 subtest 'add() tests' => sub {
139 plan tests => 18;
141 $schema->storage->txn_begin;
143 Koha::SMTP::Servers->search->delete;
145 my $librarian = $builder->build_object(
147 class => 'Koha::Patrons',
148 value => { flags => 3**2 } # parameters flag = 3
151 my $password = 'thePassword123';
152 $librarian->set_password( { password => $password, skip_validation => 1 } );
153 my $userid = $librarian->userid;
155 my $patron = $builder->build_object(
157 class => 'Koha::Patrons',
158 value => { flags => 0 }
162 $patron->set_password( { password => $password, skip_validation => 1 } );
163 my $unauth_userid = $patron->userid;
165 my $smtp_server =
166 $builder->build_object( { class => 'Koha::SMTP::Servers' } );
167 my $smtp_server_data = $smtp_server->to_api;
168 delete $smtp_server_data->{smtp_server_id};
169 $smtp_server->delete;
171 # Unauthorized attempt to write
172 $t->post_ok(
173 "//$unauth_userid:$password@/api/v1/config/smtp_servers" => json =>
174 $smtp_server_data )->status_is(403);
176 # Authorized attempt to write invalid data
177 my $smtp_server_with_invalid_field = {
178 name => 'Some other server',
179 blah => 'blah'
182 $t->post_ok( "//$userid:$password@/api/v1/config/smtp_servers" => json =>
183 $smtp_server_with_invalid_field )->status_is(400)->json_is(
184 "/errors" => [
186 message => "Properties not allowed: blah.",
187 path => "/body"
192 # Authorized attempt to write
193 my $smtp_server_id =
194 $t->post_ok( "//$userid:$password@/api/v1/config/smtp_servers" => json =>
195 $smtp_server_data )->status_is( 201, 'SWAGGER3.2.1' )->header_like(
196 Location => qr|^\/api\/v1\/config\/smtp_servers\/\d*|,
197 'SWAGGER3.4.1'
198 )->json_is( '/name' => $smtp_server_data->{name} )
199 ->json_is( '/state' => $smtp_server_data->{state} )
200 ->json_is( '/postal_code' => $smtp_server_data->{postal_code} )
201 ->json_is( '/country' => $smtp_server_data->{country} )
202 ->tx->res->json->{smtp_server_id};
204 # Authorized attempt to create with null id
205 $smtp_server_data->{smtp_server_id} = undef;
206 $t->post_ok( "//$userid:$password@/api/v1/config/smtp_servers" => json =>
207 $smtp_server_data )->status_is(400)->json_has('/errors');
209 # Authorized attempt to create with existing id
210 $smtp_server_data->{smtp_server_id} = $smtp_server_id;
211 $t->post_ok( "//$userid:$password@/api/v1/config/smtp_servers" => json =>
212 $smtp_server_data )->status_is(400)->json_is(
213 "/errors" => [
215 message => "Read-only.",
216 path => "/body/smtp_server_id"
221 $schema->storage->txn_rollback;
224 subtest 'update() tests' => sub {
226 plan tests => 15;
228 $schema->storage->txn_begin;
230 my $librarian = $builder->build_object(
232 class => 'Koha::Patrons',
233 value => { flags => 3**2 } # parameters flag = 3
236 my $password = 'thePassword123';
237 $librarian->set_password( { password => $password, skip_validation => 1 } );
238 my $userid = $librarian->userid;
240 my $patron = $builder->build_object(
242 class => 'Koha::Patrons',
243 value => { flags => 0 }
247 $patron->set_password( { password => $password, skip_validation => 1 } );
248 my $unauth_userid = $patron->userid;
250 my $smtp_server_id =
251 $builder->build_object( { class => 'Koha::SMTP::Servers' } )->id;
253 # Unauthorized attempt to update
254 $t->put_ok(
255 "//$unauth_userid:$password@/api/v1/config/smtp_servers/$smtp_server_id"
256 => json => { name => 'New unauthorized name change' } )
257 ->status_is(403);
259 # Attempt partial update on a PUT
260 my $smtp_server_with_missing_field = {
261 host => 'localhost',
262 ssl_mode => 'disabled'
265 $t->put_ok(
266 "//$userid:$password@/api/v1/config/smtp_servers/$smtp_server_id" =>
267 json => $smtp_server_with_missing_field )->status_is(400)
268 ->json_is( "/errors" =>
269 [ { message => "Missing property.", path => "/body/name" } ] );
271 # Full object update on PUT
272 my $smtp_server_with_updated_field = { name => "Some name", };
274 $t->put_ok(
275 "//$userid:$password@/api/v1/config/smtp_servers/$smtp_server_id" =>
276 json => $smtp_server_with_updated_field )->status_is(200)
277 ->json_is( '/name' => 'Some name' );
279 # Authorized attempt to write invalid data
280 my $smtp_server_with_invalid_field = {
281 blah => "Blah",
282 name => 'Some name'
285 $t->put_ok(
286 "//$userid:$password@/api/v1/config/smtp_servers/$smtp_server_id" =>
287 json => $smtp_server_with_invalid_field )->status_is(400)->json_is(
288 "/errors" => [
290 message => "Properties not allowed: blah.",
291 path => "/body"
296 my $smtp_server_to_delete =
297 $builder->build_object( { class => 'Koha::SMTP::Servers' } );
298 my $non_existent_id = $smtp_server_to_delete->id;
299 $smtp_server_to_delete->delete;
301 $t->put_ok(
302 "//$userid:$password@/api/v1/config/smtp_servers/$non_existent_id" =>
303 json => $smtp_server_with_updated_field )->status_is(404);
305 # Wrong method (POST)
306 $smtp_server_with_updated_field->{smtp_server_id} = 2;
308 $t->post_ok(
309 "//$userid:$password@/api/v1/config/smtp_servers/$smtp_server_id" =>
310 json => $smtp_server_with_updated_field )->status_is(404);
312 $schema->storage->txn_rollback;
315 subtest 'delete() tests' => sub {
317 plan tests => 7;
319 $schema->storage->txn_begin;
321 my $librarian = $builder->build_object(
323 class => 'Koha::Patrons',
324 value => { flags => 3**2 } # parameters flag = 3
327 my $password = 'thePassword123';
328 $librarian->set_password( { password => $password, skip_validation => 1 } );
329 my $userid = $librarian->userid;
331 my $patron = $builder->build_object(
333 class => 'Koha::Patrons',
334 value => { flags => 0 }
338 $patron->set_password( { password => $password, skip_validation => 1 } );
339 my $unauth_userid = $patron->userid;
341 my $smtp_server_id =
342 $builder->build_object( { class => 'Koha::SMTP::Servers' } )->id;
344 # Unauthorized attempt to delete
345 $t->delete_ok(
346 "//$unauth_userid:$password@/api/v1/config/smtp_servers/$smtp_server_id"
347 )->status_is(403);
349 $t->delete_ok(
350 "//$userid:$password@/api/v1/config/smtp_servers/$smtp_server_id")
351 ->status_is( 204, 'SWAGGER3.2.4' )->content_is( '', 'SWAGGER3.3.4' );
353 $t->delete_ok(
354 "//$userid:$password@/api/v1/config/smtp_servers/$smtp_server_id")
355 ->status_is(404);
357 $schema->storage->txn_rollback;