Commit Graph

844 Commits

Author SHA1 Message Date
Pedro Amorim c28386ac74
Bug 39091: Add cash registers list REST API endpoint
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 6649b406c1)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:47:56 +02:00
Matt Blenkinsop 77864ff6d4
Bug 40417: Remove 'validation' method
We shouldn't use the ->validation method anymore as it isn't stable. We need to pass the params into the method accounting for any param changes made

Test plan:
1) Apply the regression test patch and run the test
2) Test should fail
3) Apply this patch
4) Run test again
5) Test should pass

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f30b6f668c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:47:55 +02:00
Tomas Cohen Arazi 274bf141ab
Bug 40424: Make query-in-body rely on `$c->req->json`
This patch removes the reliance on `$c->validation->output` for the
query-in-body feature. This will allow bug 40417 to move forward.

It also fixes some wrong design decisions we made 5-6 years ago. This
was discussed with the Mojolicious::Plugin::OpenAPI maintainer and the
agreement was `$c->validation->output` was not stable nor intended to be
accessed like we do.

To test:
1. Run:
   $ ktd --shell
  k$ prove t/Koha/REST/Plugin/Query.t \
           t/db_dependent/api/v1/*.t \
           t/db_dependent/Koha/REST/Plugin/*
=> SUCCESS: Tests pass!
2. Apply this patchset
3. Repeat 1
=> SUCCESS: Tests pass!
4. Sign off :-D

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 17b851bff0)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:47:54 +02:00
Tomas Cohen Arazi d81809b4ba
Bug 40424: Simplify existing code - preparation
I wanted to isolate the changes for the query-in-body handling and it
made sense to refactor this dupicated code at the same time. So I add
this patch for tidying the area in preparation for the other part.

Duplicated code gets simplified.

To test:
1. Apply the unit tests patch
2. Run:
   $ ktd --shell
  k$ prove t/Koha/REST/Plugin/Query.t \
           t/db_dependent/api/v1/*.t \
           t/db_dependent/Koha/REST/Plugin/
=> SUCCESS: Tests pass!
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 710bf4bb1b)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:47:54 +02:00
Tomas Cohen Arazi 5eb0968866
Bug 40423: Add helper to stash x-koha-request-id header value
This patch aligns handling of the header with how other headers are
managed.

* A helper is added which reads the header and stashes the value
* The helper is called in the same place similar helpers are called
  (authenticate_api_request)
* The `objects.search_rs` helper is adjusted to use the stashed value
  instead of picking it from the reserved params.

To test:
1. Apply this patches
2. Run:
   $ ktd --shell
  k$ prove t/Koha/REST/Plugin/Query.t \
           t/db_dependent/api/v1/*.t \
           t/db_dependent/Koha/REST/Plugin/*
=> SUCCESS: Tests pass! No behavior change!
3. Sign off :-D

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5e94e44ee2)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:47:53 +02:00
Tomas Cohen Arazi 62104a03a3
Bug 40419: Fix wrong license
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 6f1bd24e87)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-07-24 10:23:34 +02:00
Tomas Cohen Arazi 746024e2eb
Bug 40254: Fix error in overrides check allowing too much
This patch fixes a subtle (yet naive) error making the controller not
care about blocking conditions if they were more than one and the first
one was overridden.

To test:
1. Apply the regression tests
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/holds.t
=> FAIL: Tests fail! Some tests expect a 409 (denied for a conflict) but
return a 201!
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit afd00523a3)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-07-10 22:47:17 +02:00
Tomas Cohen Arazi dcca39d465
Bug 39657: Add more checks and overrides to hold creation endpoint
This patch adds new behaviors to the `POST /holds` endpoint.

It uses the framework we created in the past for overriding policy
rules, and add new options:

* expired
* debt_limit
* bad_address
* card_lost
* restricted
* hold_limit

Some status codes are changed from 403 to 409. This should be revisited
accross the codebase, as I think we made a wrong choice. Happy to review
in this bug.

The feature makes use of the newly introduced
`$patron->can_place_holds()` method, which accepts to be passed through
the overrides.

To test:
1. Apply this patches
2. Run:
   $ ktd --shell
  k$ yarn api:bundle
  k$ koha-plack --restart kohadev
  k$ prove t/db_dependent/api/v1/holds.t
=> SUCCESS: Tests pass!
3. Test the endpoint with the various scenarios using your favourite
   REST tool (Postman!)
4. Sign off :-D

Signed-off-by: Kristi Krueger <kkrueger@cuyahogalibrary.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f245ad1605)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-07-10 22:47:16 +02:00
Jonathan Druart 9d72067523
Bug 38010: Fix vendor deletion tests
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:31 +02:00
Matt Blenkinsop 48592d9d3d
Bug 38010: Add protection logic to the DELETE endpoint
Amended-by: Jonathan Druart
typo: subsicriptions => subscriptions

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:30 +02:00
Matt Blenkinsop fb4f2e42b1
Bug 38010: Migrate to_api logic to GET endpoint
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:28 +02:00
Matt Blenkinsop 9105ba1e63
Bug 38010: (QA follow-up) Move syspref values to config endpoint
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:26 +02:00
Jonathan Druart 1e780ea61d
Bug 38010: Add tests for embed contacts,interfaces,aliases
(cherry picked from commit cae75569e6e8f2bfe5a2e6d3acc111485f81cc1e)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:25 +02:00
Jonathan Druart 9c1f586b3d
Bug 38010: Fix wrong use of scalar in the REST API controller
It was wrong, we need to use scalar on the array, not the arrayref
(otherwise it will always be true)
No change in behaviour expected here, just some code cleaning

(cherry picked from commit 7abbcb7ba73da13d988202aaf06ba239e21692da)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:25 +02:00
Matt Blenkinsop 7d0b44d9dc
Bug 38010: (QA follow-up) Add a config endpoint for permissions
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:16 +02:00
Matt Blenkinsop 64a43ee022
Bug 38010: (QA follow-up) Handle form parameters in the browser
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:14 +02:00
Matt Blenkinsop 6fa18591cb
Bug 38010: (QA follow-up) UI fixes
This patch addresses
- Translation issues in VendorList
- Removing the pagers from the contracts table
- Removing redundant code from the vendors template file

Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:13 +02:00
Matt Blenkinsop 29ca78bb48
Bug 38010: Prevent vendor contacts from duplicating
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:18:55 +02:00
Matt Blenkinsop d4c3342262
Bug 38010: Reset basket view
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:18:49 +02:00
Matt Blenkinsop 86bb920254
Bug 38010: Respect AcqViewBaskets syspref
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:18:42 +02:00
Matt Blenkinsop 8e99ee7dd6
Bug 38010: Adjust vendor update logic
This patch handles the embedded data that might also need updating when editing a vendor

Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:18:36 +02:00
Matt Blenkinsop 1018810681
Bug 38010: Add the form to add a new vendor
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:18:30 +02:00
Jonathan Druart 1d844a7d2f
Bug 39325: Automatic fix
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-28 18:51:22 +02:00
Tomas Cohen Arazi 814af57e83
Bug 39600: Rewrite API controllers
This patch splits the controller in two:

* A controller for staff users use
* An unprivileged access controller

A new endpoint is added for publi access:

* `/public/patrons/:patron_id/ill/requests`

The public one makes use of the state-of-the-art in Koha for public
endpoints, using the `$c->auth->public` validation helper and leaving
the (newly added) public path spec with no special permissions
requirements.

The staff-oriented endpoint gets the right permissions added (at least
those used in the main `/ill/requests` endpoint.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ yarn api:bundle
  k$ prove t/db_dependent/api/v1/ill_requests.t
=> SUCCESS: Tests pass!
3. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Tadeusz „tadzik” Sośnierz <tadeusz@sosnierz.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 19:23:41 +02:00
Tadeusz „tadzik” Sośnierz a715c695f7
Bug 39600: Cleanup the changes -- tidy, document, add a missing TT filter
Sponsored-by: Wiko <https://www.wiko-berlin.de/>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 19:23:40 +02:00
Tadeusz „tadzik” Sośnierz 4929170536
Bug 39600: Implement public_read_lists for ILL::Request and ::Attribute
Sponsored-by: Wiko <https://www.wiko-berlin.de/>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 19:23:38 +02:00
Tadeusz „tadzik” Sośnierz 44743bc3c7
Bug 39600: Switch OPAC ILL request listing to server-side rendering
This brings it technologically closer to intranet's ILL table and also enables pagination.

Test plan:

1. In KTD, go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=master+switch and enable the ILL module
2. Run the following in koha-shell to populate the request list for user `koha`:

    perl -Mt::lib::TestBuilder -e '
      my $builder = t::lib::TestBuilder->new;

      do {
        $builder->build_sample_ill_request({borrowernumber => 51});
      } for (1..50);
    '
3. Navigate to http://localhost:8080/cgi-bin/koha/opac-illrequests.pl, log in as `koha` as needed
4. Observe the new request list being paginated and server-side-sortable

Sponsored-by: Wiko <https://www.wiko-berlin.de/>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 19:23:38 +02:00
Jonathan Druart 9fbff51f0a
Bug 39367: Automatic changes
Added head2 right before sub with missing POD

Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-23 09:35:14 +02:00
Jonathan Druart 15a030bc76
Bug 39319: Fixes for Pod::Checker
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-14 08:51:21 +02:00
Julian Maurice 751391cc5c
Bug 37286: Fix REST API authentication when using Mojo apps
Koha::REST::V1::Auth checks the request URL path and do various things
depending on how it looks.
For instance, it allows everyone to access paths starting with
"/api/v1/oauth/"

But because of how Koha::REST::V1 was written, when using mojolicious
applications Koha::App::Intranet and Koha::App::Opac, paths had to add a
path prefix ("/api"), which means the final path as seen by
Koha::REST::V1::Auth looked like this: "/api/api/v1/oauth".

I said "had to", but actually there is another way that does not require
this path manipulation and that's what this patch does:

Koha::REST::V1 now accepts a configuration parameter that allows to
change the base path for API routes, which allows
Koha::App::Plugin::RESTV1 (used by Koha::App::Intranet and
Koha::App::Opac) to generate the right routes.

This configuration parameter defaults to "/api/v1", so when outside of
Koha::App::Intranet and Koha::App::Opac (when using
debian/templates/plack.psgi for instance), the behavior is unchanged.

Test plan:
1. Do not apply the patch yet
2. Run `bin/intranet daemon -l http://*:8080`
3. Run `curl -i -d{} http://127.0.0.1:8080/api/v1/oauth/token`
   It should return a 403 error, with an error message "Authentication
   failure".
4. Stop `bin/intranet daemon -l http://*:8080` by hitting Ctrl-C on the
   terminal you started it
5. Apply the patch
6. Run `bin/intranet daemon -l http://*:8080` again
7. Run `curl -i -d{} http://127.0.0.1:8080/api/v1/oauth/token`
   This time it should return a 400 error with an error message saying
   the "grant_type" property is missing.
   This error is normal as we did not send any data in the POST request
   body, and seeing this means Koha allowed us to use that route because
   it recognized '/api/v1/oauth/' at the start of the URL path
8. You can do the same test with `bin/opac`

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Works as advertised. See Bugzilla for notes from testing.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-17 08:21:23 +01:00
Julian Maurice e4bf517b55
Bug 38454: Flush memory cache before every API request
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:41 +01:00
Lari Taskula b75bf9a84a
Bug 28907: REST - Drop support for allow-owner functionality
...and allow-guarantor functionality. Replaced by $c->auth->public($patron_id)
and/or $c->auth->public_guarantor($patron_id), where $patron_id is the patron's
id that owns the requested resource.

Old method, was applicable to both privileged and public routes:

  api/v1/swagger/paths/route.yaml

  x-koha-authorization:
    allow-owner: true
    allow-guarantor: true

New method, use public routes with no x-koha-authorization:

  GET /public/route/{patron_id}
  Koha/REST/V1/Controller#public_action:

  sub public_action {
      my $c = shift->openapi->valid_input or return;
      my $patron_id = $c->param( 'patron_id' );
      try {
          # Throws an exception that will render a response of 401 if not
          # authenticated and 403 if trying to access another user's resources
          $c->auth->public($patron_id); #or $c->auth->public_guarantor($patron_id)
          ...
          # other code
          ...
      }
      catch {
          $c->unhandled_exception($_);
      }
  }

  Another example of retrieving $patron_id when patron_id is not a request
  parameter:
  GET /public/another/object/{another_object_id}

  my $patron_id = Another::Object->find($another_object_id)->borrowernumber;
  try {
      # 403 if $another_object_id does not belong to API user
      $c->auth->public($patron_id);
      ...

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:34 +01:00
Lari Taskula 423588a060
Bug 28907: REST - Remove allow-owner from public article requests cancel route
To test:
1. prove t/db_dependent/api/v1/article_requests.t
2. Apply patch
3. prove t/db_dependent/api/v1/article_requests.t

Observe success in both cases.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:33 +01:00
Lari Taskula 41cac0d9fc
Bug 28907: REST - Remove allow-owner from public checkout availability route
To test:
1. prove t/db_dependent/api/v1/checkouts.t
2. Apply patch
3. prove t/db_dependent/api/v1/checkouts.t

Observe success in both cases.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:33 +01:00
Lari Taskula 53d4a37b2b
Bug 28907: REST - Remove allow-owner from public patron hold cancellation
To test:
1. prove t/db_dependent/api/v1/patrons_holds.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons_holds.t

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:32 +01:00
Lari Taskula 3a1e5d74f7
Bug 28907: REST - Remove allow-owner from public guarantors can see charges and checkouts
To test:
1. prove t/db_dependent/api/v1/patrons.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons.t

Observe success in both cases.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:31 +01:00
Lari Taskula b2e1ac1299
Bug 28907: REST - Remove allow-owner from public checkouts route
To test:
1. prove t/db_dependent/api/v1/checkouts.t
2. Apply patch
3. prove t/db_dependent/api/v1/checkouts.t

Observe success in both cases.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:31 +01:00
Lari Taskula 3ccf9d4ee1
Bug 28907: REST - Remove allow-owner from public password route
To test:
1. prove t/db_dependent/api/v1/patrons_password.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons_password.t

Observe success in both cases.

https://bugs.koha-community.org/show_bug.cgi?id=28907
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:30 +01:00
Lari Taskula f648aa453f
Bug 28907: Add Koha::REST::Plugin::Auth::PublicRoutes
To test:
1. prove t/db_dependent/Koha/REST/Plugin/Auth/PublicRoutes.t

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:29 +01:00
Lari Taskula c18964a48f
Bug 28907: Add REST exceptions for public routes auth
To test:
1. perl -c Koha/REST/Plugin/Exceptions.pm
2. perl -c Koha/Exceptions/REST.pm

More tests coming in following patches.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:29 +01:00
Johanna Räisä 2071aae29f
Bug 38253: Add lowest priority REST API endpoint for holds
This patch adds a new endpoint to toggle the lowest priority of a hold via the REST API.

To test:
1) Apply the patch
2) perl build-resources.PL
3) prove t/db_dependent/api/v1/holds.t

Sponsored-by: Koha-Suomi Oy
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-26 13:16:31 +01:00
Martin Renvoize adae95debe
Bug 37256: Add 'PUT' for circulation rule sets
Sponsored-by: Glasgow Colleges Library Group <https://library.cityofglasgowcollege.ac.uk>
Signed-off-by: George Harkins <George.Harkins@cityofglasgowcollege.ac.uk>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-18 10:55:32 +01:00
Martin Renvoize f4342c922d
Bug 37256: Defined 'context' of circulation rules
This is a follow-up to the previous bug exposing circulation rules over
the API.

We formally define a definition for a circulation rules set including a
new 'context' object the defines the context, library_id,
patron_category_id and item_type_id combination of the rules returned.

This is just a patch I missed in the last submission that I'd meant to
add and it's important for the PUT part of this patchset.

Sponsored-by: Glasgow Colleges Library Group <https://library.cityofglasgowcollege.ac.uk>
Signed-off-by: George Harkins <George.Harkins@cityofglasgowcollege.ac.uk>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-18 10:55:31 +01:00
Koha Development Team d659526b5a
Bug 38664: Tidy the whole codebase
This commit is generated using:
  % perl misc/devel/tidy.pl
*within* ktd, to get the same version of perltidy than what will be used
by our CI (currently v20230309).

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-11 14:58:24 +01:00
Julian Maurice ca5db9ffb7
Bug 38630: Make the REST API respect KohaOpacLanguage cookie
The REST API can return translated strings to the opac or staff
interface, so it should respect the KohaOpacLanguage cookie and return
translations in the same language than the interface.

Test plan:
1. Do not apply patch yet
2. Log in to koha staff interface
3. Use the browser's devtools to get the value of CGISESSID cookie
4. Make sure you have at least 2 languages installed ('en' + another
   one - I'll use 'fr-FR' as an example in this test plan)
5. Find an item and note its itemnumber and itemtype
6. Go translate this itemtype's description (admin » item types » edit
   item type » translate). Add a translation for 'en' and another one
   for your language.
7. Close your browser tab (do not logout) and restart Koha to flush the
   memory cache.
8. Execute the following commands (replace variables by the correct
   value):

    curl -sSL "$KOHA_URL/api/v1/items/$ITEMNUMBER" \
        -H 'x-koha-embed: +strings' \
        -H "Cookie: KohaOpacLanguage=en; CGISESSID=$CGISESSID" \
        | jq -r '._strings.item_type_id.str'

   If you do not have jq, it can be found in most distributions
   packages. Or you could inspect the JSON manually at the path
   /_strings/item_type_id/str

   Restart Koha again, and execute the same command but with your
   language set in KohaOpacLanguage cookie:

    curl -sSL "$KOHA_URL/api/v1/items/$ITEMNUMBER" \
        -H 'x-koha-embed: +strings' \
        -H "Cookie: KohaOpacLanguage=fr-FR; CGISESSID=$CGISESSID" \
        | jq -r '._strings.item_type_id.str'

   Depending on how Koha sort the languages (not sure how it's done),
   you should get either the 'en' one or the 'fr-FR' one, but the
   important thing is you should get the same translation, no matter
   what the value of KohaOpacLanguage is, which is the issue this patch
   is trying to fix.
9. Apply the patch and restart Koha
10. Repeat step 8. This time you should get the translation
    corresponding to the language set in KohaOpacLanguage cookie

Side note:
* The need to restart Koha before each request is due to a bug (see bug
  38454). If already pushed when you're testing this one, you don't have
  to restart.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-01-30 18:05:24 +01:00
Tomas Cohen Arazi 4d6aef19cc
Bug 38932: Make adding a credit return the Location header
This patch makes the `POST /patrons/:patron_id/account/credits` endpoint
return a valid `Location` header. Tests are added.

Bonus: the debits counterpart already returned the header, but pointed
to a non-existent endpoint (now added by bug 38931) and it gets tests
added.

To test:
1. Apply the regression tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/patrons_accounts.t
=> FAIL: The behavior is not implemented for credits.
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-01-24 16:14:30 +01:00
Tomas Cohen Arazi eab06ab69b
Bug 38929: Make POST endpoints return the `Location` header
This patch makes the POST endpoints missing the Location header return
it.

Some endpoints I skipped:

* /patrons/account/credits (doesn't have a GET route to point to)
* /patrons/account/debits (doesn't have a GET route to point to)

To test:
1. Apply the regression tests
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/authorities.t \
           t/db_dependent/api/v1/biblios.t \
           t/db_dependent/api/v1/clubs_holds.t \
           t/db_dependent/api/v1/holds.t \
           t/db_dependent/api/v1/ill_batchstatuses.t \
           t/db_dependent/api/v1/import_batch_profiles.t \
           t/db_dependent/api/v1/transfer_limits.t
=> FAIL: Tests fail! The endpoints don't return the header!
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-01-24 16:14:27 +01:00
Tomas Cohen Arazi a98760a994
Bug 38926: Make POST /biblios return 400 if AddBiblio fails
We don't have proper exceptions in the `C4::Biblio::AddBiblio` method,
but we at least know `$biblio_id` will be `undef` in the even of an
error processing the call.

This patch makes the controller handle this situation so (at least) it
is obvious that something bad happened.

To test:
1. Apply the regression tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/biblios.t
=> FAIL: Tests fail! The endpoint returns 200 even on error!
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass! The endpoint returns a 400 with a reasonable
message!
5. Sign off :-D

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-01-24 12:02:16 +01:00
Tomas Cohen Arazi d6a4637ff6
Bug 38927: Only call FindDuplicate if required
This patch makes the code call `FindDuplicate` only if
`x-confirm-not-duplicate` is not passed. This makes sense, as having it
passed makes it override any duplicate found.

This patch doesn't change any end user behavior, just makes the code
more efficient.

To test:
1. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/biblios.t
=> SUCCESS: Tests pass
2. Apply this patch
3. Repeat 1
=> SUCCESS: Tests pass, no behavior change
4. Sign off :-D

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-01-24 12:02:15 +01:00
Jonathan Druart 44b29d114f
Bug 34068: Fix tests
Several wrong things in the previous attempt:
* as_list returns an array
* as_list returns objects, ->{library_id} does not exist
* as_list does not returns api object, you need to call ->branchcode to
  get the id
* $pickup_locations defined for both situations was confusing

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-01-10 19:19:21 +01:00