Bug 28907: REST - Remove allow-owner from public patron hold cancellation

To test:
1. prove t/db_dependent/api/v1/patrons_holds.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons_holds.t

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

Koha/REST/V1/Patrons/Holds.pm

@@ -21,6 +21,8 @@ use Mojo::Base 'Mojolicious::Controller';
 
 use Koha::Patrons;
 
+use Try::Tiny;
+
 =head1 NAME
 
 Koha::REST::V1::Patrons::Holds
@@ -72,6 +74,8 @@ sub delete_public {
     my $c = shift->openapi->valid_input or return;
 
     return try {
+        $c->auth->public( $c->param('patron_id') );
+
         my $hold = $c->objects->find_rs( Koha::Holds->new, $c->param('hold_id') );
 
         unless ( $hold and $c->param('patron_id') == $hold->borrowernumber ) {

api/v1/swagger/paths/public_patrons.yaml

@@ -278,5 +278,3 @@
         description: Under maintenance
         schema:
           $ref: "../swagger.yaml#/definitions/error"
-    x-koha-authorization:
-      allow-owner: true

t/db_dependent/api/v1/patrons_holds.t

@@ -93,7 +93,7 @@ subtest 'list() tests' => sub {
 
 subtest 'delete_public() tests' => sub {
 
-    plan tests => 13;
+    plan tests => 18;
 
     $schema->storage->txn_begin;
 
@@ -113,11 +113,20 @@ subtest 'delete_public() tests' => sub {
     my $deleted_hold_id = $hold_to_delete->id;
     $hold_to_delete->delete;
 
+    $t->delete_ok( "/api/v1/public/patrons/" . $patron->id . '/holds/' . $deleted_hold_id )->status_is(401)
+        ->json_is( { error => 'Authentication failure.' } );
+
     $t->delete_ok( "//$userid:$password@/api/v1/public/patrons/" . $patron->id . '/holds/' . $deleted_hold_id )
         ->status_is(404);
 
     my $another_user_hold = $builder->build_object( { class => 'Koha::Holds' } );
 
+    $t->delete_ok( "//$userid:$password@/api/v1/public/patrons/"
+            . $another_user_hold->borrowernumber
+            . '/holds/'
+            . $another_user_hold->id )
+        ->json_is( { error => "Unprivileged user cannot access another user's resources" } );
+
     $t->delete_ok( "//$userid:$password@/api/v1/public/patrons/" . $patron->id . '/holds/' . $another_user_hold->id )
         ->status_is( 404, 'Invalid patron_id and hold_id combination yields 404' );