From 41cac0d9fca34ebc7204de955112ab625144fe0e Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Wed, 18 Sep 2024 11:13:23 +0000 Subject: [PATCH] Bug 28907: REST - Remove allow-owner from public checkout availability route To test: 1. prove t/db_dependent/api/v1/checkouts.t 2. Apply patch 3. prove t/db_dependent/api/v1/checkouts.t Observe success in both cases. Signed-off-by: Victor Grousset/tuxayo Signed-off-by: Marcel de Rooy Signed-off-by: Katrin Fischer --- Koha/REST/V1/Checkouts.pm | 11 ++++++++++- api/v1/swagger/paths/checkouts.yaml | 4 +--- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/Koha/REST/V1/Checkouts.pm b/Koha/REST/V1/Checkouts.pm index b2e86603b9..8ff774edc2 100644 --- a/Koha/REST/V1/Checkouts.pm +++ b/Koha/REST/V1/Checkouts.pm @@ -153,7 +153,16 @@ sub get_availability { my $c = shift->openapi->valid_input or return; my $user = $c->stash('koha.user'); - my $patron = Koha::Patrons->find( $c->param('patron_id') ); + my $patron_id = $c->param('patron_id'); + + return if try { + $c->auth->public($patron_id) if $c->stash('is_public'); + return 0; # authorization successful, do not "return" after try-catch + } catch { + return $c->unhandled_exception($_); + }; + + my $patron = Koha::Patrons->find($patron_id); my $item = Koha::Items->find( $c->param('item_id') ); my ( $impossible, $confirmation, $warnings ) = $c->_check_availability( $patron, $item ); diff --git a/api/v1/swagger/paths/checkouts.yaml b/api/v1/swagger/paths/checkouts.yaml index 3f279ea34e..a6d63ff1ad 100644 --- a/api/v1/swagger/paths/checkouts.yaml +++ b/api/v1/swagger/paths/checkouts.yaml @@ -454,6 +454,4 @@ "503": description: Under maintenance schema: - $ref: "../swagger.yaml#/definitions/error" - x-koha-authorization: - allow-owner: true + $ref: "../swagger.yaml#/definitions/error" \ No newline at end of file