3 # This file is part of Koha.
5 # Koha is free software; you can redistribute it and/or modify it
6 # under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
10 # Koha is distributed in the hope that it will be useful, but
11 # WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 use Test
::More tests
=> 5;
24 use t
::lib
::TestBuilder
;
28 use Koha
::Acquisition
::Booksellers
;
31 my $schema = Koha
::Database
->new->schema;
32 my $builder = t
::lib
::TestBuilder
->new;
34 # FIXME: sessionStorage defaults to mysql, but it seems to break transaction handling
35 # this affects the other REST api tests
36 t
::lib
::Mocks
::mock_preference
( 'SessionStorage', 'tmp' );
38 my $remote_address = '127.0.0.1';
39 my $t = Test
::Mojo
->new('Koha::REST::V1');
41 subtest
'list() and delete() tests | authorized user' => sub {
45 $schema->storage->txn_begin;
47 $schema->resultset('Aqbasket')->search->delete;
48 Koha
::Acquisition
::Booksellers
->search->delete;
49 my ( $borrowernumber, $session_id )
50 = create_user_and_session
( { authorized
=> 1 } );
52 ## Authorized user tests
53 # No vendors, so empty array should be returned
54 my $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors' );
55 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
56 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
61 my $vendor_name = 'Ruben libros';
62 my $vendor = $builder->build_object({ class => 'Koha::Acquisition::Booksellers', value
=> { name
=> $vendor_name } });
64 # One vendor created, should get returned
65 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors' );
66 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
67 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
70 ->json_like( '/0/name' => qr/$vendor_name/ );
72 my $other_vendor_name = 'Amerindia';
74 = $builder->build_object({ class => 'Koha::Acquisition::Booksellers', value
=> { name
=> $other_vendor_name } });
76 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors' );
77 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
78 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
81 ->json_like( '/0/name' => qr/Ruben/ )
82 ->json_like( '/1/name' => qr/Amerindia/ );
84 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors?name=' . $vendor_name );
85 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
86 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
89 ->json_like( '/0/name' => qr/Ruben/ );
91 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors?name=' . $other_vendor_name );
92 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
93 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
96 ->json_like( '/0/name' => qr/Amerindia/ );
98 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors?accountnumber=' . $vendor->accountnumber );
99 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
100 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
103 ->json_like( '/0/name' => qr/Ruben/ );
105 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors?accountnumber=' . $other_vendor->accountnumber );
106 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
107 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
110 ->json_like( '/0/name' => qr/Amerindia/ );
112 $tx = $t->ua->build_tx( DELETE
=> '/api/v1/acquisitions/vendors/' . $vendor->id );
113 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
114 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
116 ->status_is(204, 'SWAGGER3.2.4')
117 ->content_is('', 'SWAGGER3.3.4');
119 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors' );
120 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
121 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
124 ->json_like( '/0/name' => qr/$other_vendor_name/ )
125 ->json_hasnt( '/1', 'Only one vendor' );
127 $tx = $t->ua->build_tx( DELETE
=> '/api/v1/acquisitions/vendors/' . $other_vendor->id );
128 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
129 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
131 ->status_is(204, 'SWAGGER3.2.4')
132 ->content_is('', 'SWAGGER3.3.4');
134 $tx = $t->ua->build_tx( GET
=> '/api/v1/acquisitions/vendors' );
135 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
136 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
141 $schema->storage->txn_rollback;
144 subtest
'get() test' => sub {
148 $schema->storage->txn_begin;
150 my $vendor = $builder->build_object({ class => 'Koha::Acquisition::Booksellers' });
151 my ( $borrowernumber, $session_id )
152 = create_user_and_session
( { authorized
=> 1 } );
154 my $tx = $t->ua->build_tx( GET
=> "/api/v1/acquisitions/vendors/" . $vendor->id );
155 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
156 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
159 ->json_is( $vendor->to_api );
161 my $non_existent_id = $vendor->id + 1;
162 $tx = $t->ua->build_tx( GET
=> "/api/v1/acquisitions/vendors/" . $non_existent_id );
163 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $session_id } );
164 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
167 ->json_is( '/error' => 'Vendor not found' );
169 my ( $unauthorized_borrowernumber, $unauthorized_session_id )
170 = create_user_and_session
( { authorized
=> 0 } );
171 $tx = $t->ua->build_tx( GET
=> "/api/v1/acquisitions/vendors/" . $vendor->id );
172 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $unauthorized_session_id } );
173 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
176 ->json_is( '/error', 'Authorization failure. Missing required permission(s).' );
178 $schema->storage->txn_rollback;
181 subtest
'add() tests' => sub {
185 $schema->storage->txn_begin;
187 my ( $unauthorized_borrowernumber, $unauthorized_session_id )
188 = create_user_and_session
( { authorized
=> 0 } );
189 my ( $authorized_borrowernumber, $authorized_session_id )
190 = create_user_and_session
( { authorized
=> 1 } );
191 my $vendor = { name
=> 'Ruben libros' };
193 # Unauthorized attempt to write
194 my $tx = $t->ua->build_tx( POST
=> "/api/v1/acquisitions/vendors" => json
=> $vendor );
195 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $unauthorized_session_id } );
196 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
200 # Authorized attempt to write invalid data
201 my $vendor_with_invalid_field = {
203 address5
=> 'An address'
206 $tx = $t->ua->build_tx(
207 POST
=> "/api/v1/acquisitions/vendors" => json
=> $vendor_with_invalid_field );
208 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
209 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
214 { message
=> "Properties not allowed: address5.",
220 # Authorized attempt to write
221 $tx = $t->ua->build_tx( POST
=> "/api/v1/acquisitions/vendors" => json
=> $vendor );
222 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
223 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
224 my $vendor_id = $t->request_ok($tx)
225 ->status_is( 201, 'SWAGGER3 .2.1' )
226 ->header_like( Location
=> qr
|^\
/api\/v1\
/acquisitions\/vendors
/\d
*|, 'SWAGGER3.4.1')
227 ->json_is( '/name' => $vendor->{name
} )
228 ->json_is( '/address1' => $vendor->{address1
} )->tx->res->json('/id')
229 ; # read the response vendor id for later use
231 # Authorized attempt to create with null id
232 $vendor->{id
} = undef;
233 $tx = $t->ua->build_tx( POST
=> "/api/v1/acquisitions/vendors" => json
=> $vendor );
234 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
235 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
238 ->json_has('/errors');
240 # Authorized attempt to create with existing id
241 $vendor->{id
} = $vendor_id;
242 $tx = $t->ua->build_tx( POST
=> "/api/v1/acquisitions/vendors" => json
=> $vendor );
243 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
244 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
249 { message
=> "Read-only.",
255 $schema->storage->txn_rollback;
258 subtest
'update() tests' => sub {
262 $schema->storage->txn_begin;
264 my ( $unauthorized_borrowernumber, $unauthorized_session_id )
265 = create_user_and_session
( { authorized
=> 0 } );
266 my ( $authorized_borrowernumber, $authorized_session_id )
267 = create_user_and_session
( { authorized
=> 1 } );
269 my $vendor_id = $builder->build( { source
=> 'Aqbookseller' } )->{id
};
271 # Unauthorized attempt to update
272 my $tx = $t->ua->build_tx( PUT
=> "/api/v1/acquisitions/vendors/$vendor_id" => json
=>
273 { city_name
=> 'New unauthorized name change' } );
274 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $unauthorized_session_id } );
275 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
279 # Attempt partial update on a PUT
280 my $vendor_without_mandatory_field = { address1
=> 'New address' };
282 $tx = $t->ua->build_tx( PUT
=> "/api/v1/acquisitions/vendors/$vendor_id" => json
=>
283 $vendor_without_mandatory_field );
284 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
285 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
288 ->json_is( "/errors" => [ { message
=> "Missing property.", path
=> "/body/name" } ] );
290 # Full object update on PUT
291 my $vendor_with_updated_field = { name
=> "London books", };
293 $tx = $t->ua->build_tx(
294 PUT
=> "/api/v1/acquisitions/vendors/$vendor_id" => json
=> $vendor_with_updated_field );
295 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
296 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
299 ->json_is( '/name' => 'London books' );
301 # Authorized attempt to write invalid data
302 my $vendor_with_invalid_field = {
304 address1
=> "Address 1",
305 address2
=> "Address 2",
306 address3
=> "Address 3"
309 $tx = $t->ua->build_tx(
310 PUT
=> "/api/v1/acquisitions/vendors/$vendor_id" => json
=> $vendor_with_invalid_field );
311 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
312 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
317 { message
=> "Properties not allowed: blah.",
323 my $non_existent_id = $vendor_id + 1;
324 $tx = $t->ua->build_tx( PUT
=> "/api/v1/acquisitions/vendors/$non_existent_id" => json
=>
325 $vendor_with_updated_field );
326 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
327 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
328 $t->request_ok($tx)->status_is(404);
330 $schema->storage->txn_rollback;
332 # Wrong method (POST)
333 $vendor_with_updated_field->{id
} = 2;
335 $tx = $t->ua->build_tx(
336 POST
=> "/api/v1/acquisitions/vendors/$vendor_id" => json
=> $vendor_with_updated_field );
337 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
338 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
343 subtest
'delete() tests' => sub {
347 $schema->storage->txn_begin;
349 my ( $unauthorized_borrowernumber, $unauthorized_session_id )
350 = create_user_and_session
( { authorized
=> 0 } );
351 my ( $authorized_borrowernumber, $authorized_session_id )
352 = create_user_and_session
( { authorized
=> 1 } );
354 my $vendor_id = $builder->build( { source
=> 'Aqbookseller' } )->{id
};
356 # Unauthorized attempt to update
357 my $tx = $t->ua->build_tx( DELETE
=> "/api/v1/acquisitions/vendors/$vendor_id" );
358 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $unauthorized_session_id } );
359 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
363 $tx = $t->ua->build_tx( DELETE
=> "/api/v1/acquisitions/vendors/$vendor_id" );
364 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
365 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
367 ->status_is(204, 'SWAGGER3.2.4')
368 ->content_is('', 'SWAGGER3.3.4');
370 $tx = $t->ua->build_tx( DELETE
=> "/api/v1/acquisitions/vendors/$vendor_id" );
371 $tx->req->cookies( { name
=> 'CGISESSID', value
=> $authorized_session_id } );
372 $tx->req->env( { REMOTE_ADDR
=> $remote_address } );
376 $schema->storage->txn_rollback;
379 sub create_user_and_session
{
382 my $flags = ( $args->{authorized
} ) ?
2052 : 0;
384 # my $flags = ( $args->{authorized} ) ? $args->{authorized} : 0;
385 my $dbh = C4
::Context
->dbh;
387 my $user = $builder->build(
388 { source
=> 'Borrower',
389 value
=> { flags
=> $flags }
393 # Create a session for the authorized user
394 my $session = C4
::Auth
::get_session
('');
395 $session->param( 'number', $user->{borrowernumber
} );
396 $session->param( 'id', $user->{userid
} );
397 $session->param( 'ip', '127.0.0.1' );
398 $session->param( 'lasttime', time() );
401 if ( $args->{authorized
} ) {
404 INSERT INTO user_permissions (borrowernumber,module_bit,code)
405 VALUES (?,11,'vendors_manage')},
406 undef, $user->{borrowernumber
}
410 return ( $user->{borrowernumber
}, $session->id );