From 463b92df52b21e62b8096268013ecc4f2b16c759 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Date: Wed, 29 Apr 2026 18:14:43 +0100
Subject: [PATCH] Bug 40445: (QA follow-up) Add nonce, POD, and test isolation

This patch resolves three QA findings on the cashup reconciliation
work:

* Add a CSP nonce to the inline <style> block in cashup_summary.inc
  so it is not flagged by the forbidden_patterns check.
* Document the private _get_session_end method on
  Koha::Cash::Register::Cashup so pod_coverage passes.
* Mock CashupReconciliationNoteRequired to 0 in
  t/db_dependent/Koha/Cash/Register/Cashup.t so the test does not
  depend on the site preference value (it previously failed when
  the syspref was set to "Require" because surpluses and deficits
  are created without a reconciliation note in this test).

Test plan:
1. Apply the patch.
2. Set CashupReconciliationNoteRequired to "Require".
3. Run prove t/db_dependent/Koha/Cash/Register/Cashup.t -- it should
   pass.
4. Set CashupReconciliationNoteRequired to "Don't require" and
   re-run -- it should still pass.
5. Run koha-qa.pl on the bug branch -- pod_coverage on
   Koha/Cash/Register/Cashup.pm and forbidden_patterns on
   cashup_summary.inc should now pass.

Sponsored-by: OpenFifth <https://openfifth.co.uk/>
Signed-off-by: Jackie Usher <jackie.usher@westsussex.gov.uk>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
---
 Koha/Cash/Register/Cashup.pm                      | 15 +++++++++++++++
 .../prog/en/includes/modals/cashup_summary.inc    |  2 +-
 t/db_dependent/Koha/Cash/Register/Cashup.t        |  5 +++++
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/Koha/Cash/Register/Cashup.pm b/Koha/Cash/Register/Cashup.pm
index 01ffb9fcb4..7e6ba1ac64 100644
--- a/Koha/Cash/Register/Cashup.pm
+++ b/Koha/Cash/Register/Cashup.pm
@@ -285,6 +285,21 @@ sub _get_session_boundaries {
     return ( $session_start, $session_end );
 }
 
+=head3 _get_session_end
+
+Internal method to determine the effective end timestamp of the session
+this cashup closes.
+
+For a one-phase cashup, the session ends at C<< $self->timestamp >>.
+For a two-phase workflow (a preceding C<CASHUP_START> with no intervening
+C<CASHUP>), the session ends at the C<CASHUP_START> timestamp so that
+transactions made between C<CASHUP_START> and C<CASHUP> are excluded
+from this cashup's summary.
+
+Returns the session end timestamp.
+
+=cut
+
 sub _get_session_end {
     my ($self) = @_;
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cashup_summary.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cashup_summary.inc
index cd50307449..970115594c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cashup_summary.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/modals/cashup_summary.inc
@@ -23,7 +23,7 @@
                     <tfoot> </tfoot>
                 </table>
 
-                <style>
+                <style nonce="[% Koha.CSPNonce | $raw %]">
                     #cashupSummaryModal .reconciliation-separator hr {
                         margin: 0.5rem 0;
                         border-color: #dee2e6;
diff --git a/t/db_dependent/Koha/Cash/Register/Cashup.t b/t/db_dependent/Koha/Cash/Register/Cashup.t
index 77777d8bee..2996ec2237 100755
--- a/t/db_dependent/Koha/Cash/Register/Cashup.t
+++ b/t/db_dependent/Koha/Cash/Register/Cashup.t
@@ -24,11 +24,16 @@ use Test::More tests => 6;
 use Koha::Database;
 use Koha::DateUtils qw( dt_from_string );
 
+use t::lib::Mocks;
 use t::lib::TestBuilder;
 
 my $builder = t::lib::TestBuilder->new;
 my $schema  = Koha::Database->new->schema;
 
+# Ensure tests do not depend on the site CashupReconciliationNoteRequired
+# preference; this test exercises summary/accountlines, not note enforcement.
+t::lib::Mocks::mock_preference( 'CashupReconciliationNoteRequired', 0 );
+
 subtest 'manager' => sub {
     plan tests => 2;