t/db_dependent/api/v1/auth.t

   1 #!/usr/bin/env perl
   2
   3 # This file is part of Koha.
   4 #
   5 # Koha is free software; you can redistribute it and/or modify it
   6 # under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # Koha is distributed in the hope that it will be useful, but
  11 # WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with Koha; if not, see <http://www.gnu.org/licenses>.
  17
  18 use Modern::Perl;
  19
  20 use Test::More tests => 3;
  21 use Test::Mojo;
  22 use Test::Warn;
  23
  24 use t::lib::TestBuilder;
  25 use t::lib::Mocks;
  26
  27 use C4::Auth;
  28 use Koha::Database;
  29
  30 my $schema  = Koha::Database->new->schema;
  31 my $builder = t::lib::TestBuilder->new;
  32
  33 # FIXME: sessionStorage defaults to mysql, but it seems to break transaction handling
  34 # this affects the other REST api tests
  35 t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' );
  36
  37 my $remote_address = '127.0.0.1';
  38 my $t              = Test::Mojo->new('Koha::REST::V1');
  39 my $tx;
  40
  41 subtest 'under() tests' => sub {
  42
  43     plan tests => 20;
  44
  45     $schema->storage->txn_begin;
  46
  47     my ($borrowernumber, $session_id) = create_user_and_session();
  48
  49     # disable the /public namespace
  50     t::lib::Mocks::mock_preference( 'RESTPublicAPI', 0 );
  51     $tx = $t->ua->build_tx( POST => "/api/v1/public/patrons/$borrowernumber/password" );
  52     $tx->req->env( { REMOTE_ADDR => $remote_address } );
  53     $t->request_ok($tx)
  54       ->status_is(403)
  55       ->json_is('/error', 'Configuration prevents the usage of this endpoint by unprivileged users');
  56
  57     # enable the /public namespace
  58     t::lib::Mocks::mock_preference( 'RESTPublicAPI', 1 );
  59     $tx = $t->ua->build_tx( GET => "/api/v1/public/patrons/$borrowernumber/password" );
  60     $tx->req->env( { REMOTE_ADDR => $remote_address } );
  61     $t->request_ok($tx)->status_is(404);
  62
  63     # 401 (no authentication)
  64     $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
  65     $tx->req->env( { REMOTE_ADDR => $remote_address } );
  66     $t->request_ok($tx)
  67       ->status_is(401)
  68       ->json_is('/error', 'Authentication failure.');
  69
  70     # 403 (no permission)
  71     $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
  72     $tx->req->cookies(
  73         { name => 'CGISESSID', value => $session_id } );
  74     $tx->req->env( { REMOTE_ADDR => $remote_address } );
  75     $t->request_ok($tx)
  76       ->status_is(403)
  77       ->json_is('/error', 'Authorization failure. Missing required permission(s).');
  78
  79     # 401 (session expired)
  80     t::lib::Mocks::mock_preference( 'timeout', '1' );
  81     ($borrowernumber, $session_id) = create_user_and_session();
  82     $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
  83     $tx->req->cookies(
  84         { name => 'CGISESSID', value => $session_id } );
  85     $tx->req->env( { REMOTE_ADDR => $remote_address } );
  86     sleep(2);
  87     $t->request_ok($tx)
  88       ->status_is(401)
  89       ->json_is('/error', 'Session has been expired.');
  90
  91     # 503 (under maintenance & pending update)
  92     t::lib::Mocks::mock_preference('Version', 1);
  93     $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
  94     $tx->req->env( { REMOTE_ADDR => $remote_address } );
  95     $t->request_ok($tx)
  96       ->status_is(503)
  97       ->json_is('/error', 'System is under maintenance.');
  98
  99     # 503 (under maintenance & database not installed)
 100     t::lib::Mocks::mock_preference('Version', undef);
 101     $tx = $t->ua->build_tx( GET => "/api/v1/patrons" );
 102     $tx->req->env( { REMOTE_ADDR => $remote_address } );
 103     $t->request_ok($tx)
 104       ->status_is(503)
 105       ->json_is('/error', 'System is under maintenance.');
 106
 107     $schema->storage->txn_rollback;
 108 };
 109
 110 subtest 'CORS support' => sub {
 111
 112     plan tests => 6;
 113
 114     t::lib::Mocks::mock_preference('AccessControlAllowOrigin','');
 115     $t->get_ok("/api/v1/patrons")
 116       ->header_is( 'Access-control-allow-origin', undef, 'Header not returned' );
 117       # FIXME: newer Test::Mojo has header_exists_not
 118
 119     t::lib::Mocks::mock_preference('AccessControlAllowOrigin',undef);
 120     $t->get_ok("/api/v1/patrons")
 121       ->header_is( 'Access-control-allow-origin', undef, 'Header not returned' );
 122     # FIXME: newer Test::Mojo has header_exists_not
 123
 124     t::lib::Mocks::mock_preference('AccessControlAllowOrigin','*');
 125     $t->get_ok("/api/v1/patrons")
 126       ->header_is( 'Access-control-allow-origin', '*', 'Header set' );
 127 };
 128
 129 subtest 'spec retrieval tests' => sub {
 130
 131     plan tests => 4;
 132
 133     $t->get_ok("/api/v1/")
 134       ->status_is(200);
 135
 136     $t->get_ok("/api/v1/.html")
 137       ->status_is(200);
 138 };
 139
 140 sub create_user_and_session {
 141     my $user = $builder->build(
 142         {
 143             source => 'Borrower',
 144             value  => {
 145                 flags => 0
 146             }
 147         }
 148     );
 149
 150     # Create a session for the authorized user
 151     my $session = C4::Auth::get_session('');
 152     $session->param( 'number',   $user->{borrowernumber} );
 153     $session->param( 'id',       $user->{userid} );
 154     $session->param( 'ip',       '127.0.0.1' );
 155     $session->param( 'lasttime', time() );
 156     $session->flush;
 157
 158     return ( $user->{borrowernumber}, $session->id );
 159 }
 160
 161 1;