3 # This file is part of Koha.
5 # Koha is free software; you can redistribute it and/or modify it under the
6 # terms of the GNU General Public License as published by the Free Software
7 # Foundation; either version 3 of the License, or (at your option) any later
10 # Koha is distributed in the hope that it will be useful, but WITHOUT ANY
11 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
12 # A PARTICULAR PURPOSE. See the GNU General Public License for more details.
14 # You should have received a copy of the GNU General Public License along
15 # with Koha; if not, write to the Free Software Foundation, Inc.,
16 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
20 use Test
::More tests
=> 5;
24 use t
::lib
::TestBuilder
;
28 use Koha
::Acquisition
::Booksellers
;
31 my $schema = Koha
::Database
->new->schema;
32 my $builder = t
::lib
::TestBuilder
->new;
34 # FIXME: sessionStorage defaults to mysql, but it seems to break transaction handling
35 # this affects the other REST api tests
36 t
::lib
::Mocks
::mock_preference
( 'SessionStorage', 'tmp' );
38 my $remote_address = '127.0.0.1';
39 my $t = Test
::Mojo
->new('Koha::REST::V1');
41 subtest
'list() and delete() tests | authorized user' => sub {
45 $schema->storage->txn_begin;
47 $schema->resultset('Aqbasket')->search->delete;
48 Koha
::Acquisition
::Booksellers
->search->delete;
49 my ( $borrowernumber, $session_id )
50 = create_user_and_session
( { authorized
=> 1 } );
52 ## Authorized user tests
53 # No vendors, so empty array should be returned
54 my $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors' );
55 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
56 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
61 my $vendor_name = 'Ruben libros';
62 my $vendor = $builder->build_object({ class => 'Koha::Acquisition::Booksellers', value
=> { name
=> $vendor_name } });
64 # One vendor created, should get returned
65 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors' );
66 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
67 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
70 ->json_like( '/0/name' => qr/$vendor_name/ );
72 my $other_vendor_name = 'Amerindia';
74 = $builder->build_object({ class => 'Koha::Acquisition::Booksellers', value
=> { name
=> $other_vendor_name } });
76 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors' );
77 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
78 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
81 ->json_like( '/0/name' => qr/Ruben/ )
82 ->json_like( '/1/name' => qr/Amerindia/ );
84 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors?name=' . $vendor_name );
85 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
86 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
89 ->json_like( '/0/name' => qr/Ruben/ );
91 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors?name=' . $other_vendor_name );
92 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
93 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
96 ->json_like( '/0/name' => qr/Amerindia/ );
98 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors?accountnumber=' . $vendor->accountnumber );
99 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
100 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
103 ->json_like( '/0/name' => qr/Ruben/ );
105 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors?accountnumber=' . $other_vendor->accountnumber );
106 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
107 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
110 ->json_like( '/0/name' => qr/Amerindia/ );
112 $tx = $t->ua->build_tx( DELETE
=> '/api/v1/acquisitions/vendors/' . $vendor->id );
113 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
114 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
119 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors' );
120 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
121 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
124 ->json_like( '/0/name' => qr/$other_vendor_name/ )
125 ->json_hasnt( '/1', 'Only one vendor' );
127 $tx = $t->ua->build_tx( DELETE
=> '/api/v1/acquisitions/vendors/' . $other_vendor->id );
128 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
129 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
134 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors' );
135 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
136 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
141 $schema->storage->txn_rollback;
144 subtest
'get() test' => sub {
148 $schema->storage->txn_begin;
150 my $vendor = $builder->build_object({ class => 'Koha::Acquisition::Booksellers' });
151 my ( $borrowernumber, $session_id )
152 = create_user_and_session
( { authorized
=> 1 } );
154 my $tx = $t->ua->build_tx( GET
=> "/api/v1/acquisitions/vendors/" . $vendor->id );
155 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
156 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
159 ->json_is( Koha
::REST
::V1
::Acquisitions
::Vendors
::_to_api
( $vendor->TO_JSON ) );
161 my $non_existent_id = $vendor->id + 1;
162 $tx = $t->ua->build_tx( GET
=> "/api/v1/acquisitions/vendors/" . $non_existent_id );
163 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
164 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
167 ->json_is( '/error' => 'Vendor not found' );
169 my ( $unauthorized_borrowernumber, $unauthorized_session_id )
170 = create_user_and_session
( { authorized
=> 0 } );
171 $tx = $t->ua->build_tx( GET
=> "/api/v1/acquisitions/vendors/" . $vendor->id );
172 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $unauthorized_session_id } );
173 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
176 ->json_is( '/error', 'Authorization failure. Missing required permission(s).' );
178 $schema->storage->txn_rollback;
181 subtest
'add() tests' => sub {
185 $schema->storage->txn_begin;
187 my ( $unauthorized_borrowernumber, $unauthorized_session_id )
188 = create_user_and_session
( { authorized
=> 0 } );
189 my ( $authorized_borrowernumber, $authorized_session_id )
190 = create_user_and_session
( { authorized
=> 1 } );
191 my $vendor = { name
=> 'Ruben libros' };
193 # Unauthorized attempt to write
194 my $tx = $t->ua->build_tx( POST
=> "/api/v1/acquisitions/vendors" => json
=> $vendor );
195 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $unauthorized_session_id } );
196 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
200 # Authorized attempt to write invalid data
201 my $vendor_with_invalid_field = {
203 address5
=> 'An address'
206 $tx = $t->ua->build_tx(
207 POST
=> "/api/v1/acquisitions/vendors" => json
=> $vendor_with_invalid_field );
208 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
209 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
214 { message
=> "Properties not allowed: address5.",
220 # Authorized attempt to write
221 $tx = $t->ua->build_tx( POST
=> "/api/v1/acquisitions/vendors" => json
=> $vendor );
222 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
223 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
224 my $vendor_id = $t->request_ok($tx)
226 ->json_is( '/name' => $vendor->{name
} )
227 ->json_is( '/address1' => $vendor->{address1
} )->tx->res->json('/id')
228 ; # read the response vendor id for later use
230 # Authorized attempt to create with null id
231 $vendor->{id
} = undef;
232 $tx = $t->ua->build_tx( POST
=> "/api/v1/acquisitions/vendors" => json
=> $vendor );
233 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
234 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
237 ->json_has('/errors');
239 # Authorized attempt to create with existing id
240 $vendor->{id
} = $vendor_id;
241 $tx = $t->ua->build_tx( POST
=> "/api/v1/acquisitions/vendors" => json
=> $vendor );
242 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
243 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
248 { message
=> "Read-only.",
254 $schema->storage->txn_rollback;
257 subtest
'update() tests' => sub {
261 $schema->storage->txn_begin;
263 my ( $unauthorized_borrowernumber, $unauthorized_session_id )
264 = create_user_and_session
( { authorized
=> 0 } );
265 my ( $authorized_borrowernumber, $authorized_session_id )
266 = create_user_and_session
( { authorized
=> 1 } );
268 my $vendor_id = $builder->build( { source
=> 'Aqbookseller' } )->{id
};
270 # Unauthorized attempt to update
271 my $tx = $t->ua->build_tx( PUT
=> "/api/v1/acquisitions/vendors/$vendor_id" => json
=>
272 { city_name
=> 'New unauthorized name change' } );
273 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $unauthorized_session_id } );
274 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
278 # Attempt partial update on a PUT
279 my $vendor_without_mandatory_field = { address1
=> 'New address' };
281 $tx = $t->ua->build_tx( PUT
=> "/api/v1/acquisitions/vendors/$vendor_id" => json
=>
282 $vendor_without_mandatory_field );
283 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
284 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
287 ->json_is( "/errors" => [ { message
=> "Missing property.", path
=> "/body/name" } ] );
289 # Full object update on PUT
290 my $vendor_with_updated_field = { name
=> "London books", };
292 $tx = $t->ua->build_tx(
293 PUT
=> "/api/v1/acquisitions/vendors/$vendor_id" => json
=> $vendor_with_updated_field );
294 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
295 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
298 ->json_is( '/name' => 'London books' );
300 # Authorized attempt to write invalid data
301 my $vendor_with_invalid_field = {
303 address1
=> "Address 1",
304 address2
=> "Address 2",
305 address3
=> "Address 3"
308 $tx = $t->ua->build_tx(
309 PUT
=> "/api/v1/acquisitions/vendors/$vendor_id" => json
=> $vendor_with_invalid_field );
310 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
311 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
316 { message
=> "Properties not allowed: blah.",
322 my $non_existent_id = $vendor_id + 1;
323 $tx = $t->ua->build_tx( PUT
=> "/api/v1/acquisitions/vendors/$non_existent_id" => json
=>
324 $vendor_with_updated_field );
325 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
326 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
327 $t->request_ok($tx)->status_is(404);
329 $schema->storage->txn_rollback;
331 # Wrong method (POST)
332 $vendor_with_updated_field->{id
} = 2;
334 $tx = $t->ua->build_tx(
335 POST
=> "/api/v1/acquisitions/vendors/$vendor_id" => json
=> $vendor_with_updated_field );
336 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
337 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
342 subtest
'delete() tests' => sub {
346 $schema->storage->txn_begin;
348 my ( $unauthorized_borrowernumber, $unauthorized_session_id )
349 = create_user_and_session
( { authorized
=> 0 } );
350 my ( $authorized_borrowernumber, $authorized_session_id )
351 = create_user_and_session
( { authorized
=> 1 } );
353 my $vendor_id = $builder->build( { source
=> 'Aqbookseller' } )->{id
};
355 # Unauthorized attempt to update
356 my $tx = $t->ua->build_tx( DELETE
=> "/api/v1/acquisitions/vendors/$vendor_id" );
357 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $unauthorized_session_id } );
358 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
362 $tx = $t->ua->build_tx( DELETE
=> "/api/v1/acquisitions/vendors/$vendor_id" );
363 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
364 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
369 $tx = $t->ua->build_tx( DELETE
=> "/api/v1/acquisitions/vendors/$vendor_id" );
370 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
371 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
375 $schema->storage->txn_rollback;
378 sub create_user_and_session
{
381 my $flags = ( $args->{authorized
} ) ?
2052 : 0;
383 # my $flags = ( $args->{authorized} ) ? $args->{authorized} : 0;
384 my $dbh = C4
::Context
->dbh;
386 my $user = $builder->build(
387 { source
=> 'Borrower',
388 value
=> { flags
=> $flags }
392 # Create a session for the authorized user
393 my $session = C4
::Auth
::get_session
('');
394 $session->param( 'number', $user->{borrowernumber
} );
395 $session->param( 'id', $user->{userid
} );
396 $session->param( 'ip', '127.0.0.1' );
397 $session->param( 'lasttime', time() );
400 if ( $args->{authorized
} ) {
403 INSERT INTO user_permissions (borrowernumber,module_bit,code)
404 VALUES (?,11,'vendors_manage')},
405 undef, $user->{borrowernumber
}
409 return ( $user->{borrowernumber
}, $session->id );