Bug 36066: Only allow cancelled order deletion in API

Note: I had trouble with listing orders in API without
status, although formally not required according specs.

Test plan:
Run t/db_dependent/api/v1/acquisitions_orders.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This commit is contained in:
Marcel de Rooy 2024-02-12 09:54:04 +00:00 committed by Katrin Fischer
parent 8bb61c4f88
commit dcbda39c0a
No known key found for this signature in database
GPG Key ID: 0EF6E2C03357A834
1 changed files with 9 additions and 1 deletions

View File

@ -183,7 +183,9 @@ sub update {
=head3 delete
Controller function that handles deleting a Koha::Patron object
Controller function that handles deleting a Koha::Acquisition::Order object
Note that we only allow deletion when the status is cancelled.
=cut
@ -197,6 +199,12 @@ sub delete {
status => 404,
openapi => { error => 'Order not found' }
);
} elsif ( ( $order->orderstatus && $order->orderstatus ne 'cancelled' ) || !$order->datecancellationprinted ) {
# Koha may (historically) have inconsistent order data here (e.g. cancelled without date)
return $c->render(
status => 403,
openapi => { error => 'Order status must be cancelled' }
);
}
return try {