Commit Graph

666 Commits

Author SHA1 Message Date
Jonathan Druart 7146ce1e92
Bug 30708: Do not allow non-authorised users to edit the settings
In case the logged in user does not have manage_sysprefs we should no
display the form in the settings.

Signed-off-by: Laurence Rault <laurence.rault@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-18 15:42:01 -03:00
Jonathan Druart f5c581b0ad
Bug 30708: Rebase - Use a dedicated 'config' endpoint
To retrieve the sysprefs, instead of using the svc script. See bug
33606.

Signed-off-by: Laurence Rault <laurence.rault@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-18 15:42:00 -03:00
Jonathan Druart 4aff88aa13
Bug 30708: Do not allow adding new items to a closed train
Sponsored-by: BULAC - http://www.bulac.fr/
Signed-off-by: BULAC - http://www.bulac.fr/
Signed-off-by: Heather Hernandez <heather_hernandez@nps.gov>
Signed-off-by: Laurence Rault <laurence.rault@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-18 15:41:47 -03:00
Jonathan Druart 3970889e71
Bug 30708: Do not allow copy item to a train if the item already exists in a non-received train
Sponsored-by: BULAC - http://www.bulac.fr/
Signed-off-by: BULAC - http://www.bulac.fr/
Signed-off-by: Heather Hernandez <heather_hernandez@nps.gov>
Signed-off-by: Laurence Rault <laurence.rault@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-18 15:41:47 -03:00
Jonathan Druart 2c61a7af95
Bug 30708: Do not allow deletion of processings that are used
Sponsored-by: BULAC - http://www.bulac.fr/
Signed-off-by: BULAC - http://www.bulac.fr/
Signed-off-by: Heather Hernandez <heather_hernandez@nps.gov>
Signed-off-by: Laurence Rault <laurence.rault@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-18 15:41:46 -03:00
Jonathan Druart eae94108e7
Bug 30708: Duplicate/copy items to an opened train
Sponsored-by: BULAC - http://www.bulac.fr/
Signed-off-by: BULAC - http://www.bulac.fr/
Signed-off-by: Heather Hernandez <heather_hernandez@nps.gov>
Signed-off-by: Laurence Rault <laurence.rault@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-18 15:41:45 -03:00
Jonathan Druart f7e6d2f1bd
Bug 30708: Add user_train_item_id
Sponsored-by: BULAC - http://www.bulac.fr/
Signed-off-by: BULAC - http://www.bulac.fr/

Signed-off-by: Heather Hernandez <heather_hernandez@nps.gov>
Signed-off-by: Laurence Rault <laurence.rault@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-18 15:41:43 -03:00
Jonathan Druart e741a86de1
Bug 30708: Add REST API controllers
Sponsored-by: BULAC - http://www.bulac.fr/
Signed-off-by: BULAC - http://www.bulac.fr/
Signed-off-by: Heather Hernandez <heather_hernandez@nps.gov>
Signed-off-by: Laurence Rault <laurence.rault@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-18 15:41:38 -03:00
Marcel de Rooy a3ce05012b
Bug 34271: Remove a few Logger statements from REST API
See also bug 22678.
We should call app->log->warn, ->debug, etc. instead of Logger.

Test plan:
The simplest way I tested V1, is add a app->log->warn in the try
blocks, restart all and check that your log4perl is set correctly
too.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-18 10:26:03 -03:00
Tomas Cohen Arazi a71140fe60
Bug 30719: (QA follow-up) Pick better column names and cleanup
This patch takes on normalizing the attribute names, embeds, and also
makes the whole API more kosher, in terms of using accessors for related
objects, using the standard structure for strings_map, etc.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-17 14:45:23 -03:00
Pedro Amorim 2102e948a8
Bug 30719: (QA follow-up) Rename illbatchstatuses
illbatchstatuses endpoint is now ill/batchstatuses

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-17 14:45:22 -03:00
Pedro Amorim 833a808cdf
Bug 30719: (QA follow-up) Rewrite remaining ill batches endpoints
get, add and update rewrite

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-17 14:45:21 -03:00
Pedro Amorim 3801c65bee
Bug 30719: (QA follow-up) Rewrite Illbatches list endpoint
Update accessors
Add +strings embed
Add x-koha-embed to batches list andpoint
Add embed to API call from the front-end
Update table to get data from _strings
Add x-koha-embed to tests
Add strings_map to Illbatch
Add to_api_mapping to Illbatch

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-17 14:45:21 -03:00
Pedro Amorim edb048de78
Bug 30719: (QA follow-up) Rename illbatches endpoint to ill/batches
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-17 14:45:20 -03:00
Pedro Amorim 33ab6fc91c
Bug 30719: (QA follow-up) c->validation fixes
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-17 14:45:18 -03:00
Pedro Amorim fc83fb3ebb
Bug 30719: (QA follow-up) Squash:
This is a squash of 25 QA patches located at:
    https://github.com/PTFS-Europe/koha/commits/new_30719

Bug 30719: (QA follow-up) Batch column should be hidden by default
Bug 30719: (QA follow-up) Fix wrong tt filter type
Bug 30719: (QA follow-up) Make atomicupdate idempotent
Bug 30719: (QA follow-up) Use COMMENT syntax in database files
Bug 30719: (QA follow-up) Fix tiny boolean is_system
Bug 30719: (QA follow-up) Add missing CONSTRAINT entries from kohastructure.sql to the atomicupdate file
Bug 30719: (QA follow-up) Add missing koha_object_class and
koha_objects_class methods
Bug 30719: (QA follow-up) Swap search to find
Bug 30719: (QA follow-up) Fix tests
Bug 30719: (QA follow-up) API terminology - id -> batch_id
Bug 30719: (QA follow-up) API terminology - borrowernumber -> patron_id
Bug 30719: (QA follow-up) API terminology - branchcode -> library_id
Bug 30719: (QA follow-up) Make mandatory illbatch_statuses translatable
Bug 30719: (QA follow-up) Improve translatability
Bug 30719: (QA follow-up) Fix capitalization of Interlibrary Loan
Bug 30719: (QA follow-up) Change Branch to Library in ILL batches table
Bug 30719: (QA follow-up) Add template WRAPPER to batch statuses breadrcrumbs
Bug 30719: (QA follow-up) Utilize patron_to_html function to display patron info in batches table
Bug 30719: (QA follow-up) Add mandatory batch statuses to the atomicupdate
Bug 30719: (QA follow-up) Add page-section to the batch statuses list page
Bug 30719: (QA follow-up) Style Save button on batch status edit page
Bug 30719: (QA follow-up) Add question mark to label string, rephrase new ILL batch button
Bug 30719: (QA follow-up) Add noExport class to action columns in batch list table and batch modal table
Bug 30719: (QA follow-up) Add page-section and headers to ILL batch table
Bug 30719: (QA follow-up) Perltidy

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-17 14:45:18 -03:00
Pedro Amorim 36680ea6c0
Bug 30719: ILL Batch Statuses
- UI adding support for batch statuses in batch UI
- Admin UI for managing batch statuses
- API specs

Co-authored-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>
Signed-off-by: Edith Speller <Edith.Speller@ukhsa.gov.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-17 14:45:16 -03:00
Pedro Amorim a5dbafec5b
Bug 30719: ILL Batches
- Add batch column to requests table
- Establish if there are any availability or metadata enrichment plugins and pass that to the template
- Verify if we have any backend that can support batches, if not, don't show the option
- Updates to the ILL toolbar
- New ILL batch modal
- New Koha classes
- API specs

Co-authored-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>
Signed-off-by: Edith Speller <Edith.Speller@ukhsa.gov.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-17 14:45:15 -03:00
Pedro Amorim 5bf5860370
Bug 30719: DB and API
- Adds 'batch' accessor to Illrequest object
- New illbatches and illbatch_statuses tables
- New foreign key 'batch_id' in illrequests table
- Atomic update file
- Default illbatch_statuses
- Add 'add' ill_requests api method
- Add POST method in ill_requests path
- Add 'batch_id property to ill_request api definition
- Updated swagger.yml with new batches and batchstatuses endpoints

Co-authored-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com>
Signed-off-by: Edith Speller <Edith.Speller@ukhsa.gov.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-17 14:45:15 -03:00
Martin Renvoize f90715782c
Bug 33690: Convert to x-koha-override
This patch converts the existing work to use x-koha-override instead of
introducing an entirely new header and we default to the system
preference value if the override isn't passed.

I believe this is more consistent with our approach in other areas of
koha to date.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 11:07:56 -04:00
Kyle M Hall 79a5509b77
Bug 33690: Add ability to send welcome notice when creating patrons using the REST API
It would be nice to have the ability to send a welcome notice when creating patrons via the API.

Test Plan:
1) Apply this patch
2) Ensure you have a WELCOME notice
3) Create a new patron using the REST API ( api/v1/patrons )
4) Note no welcome notice is sent to the patron ( you can check the
   notices tab for the patron )
5) Repeat step 3, but send the header X-Koha-SendWelcomeEmail with a
   value of 1 as part of the POST
6) Note the welcome message for the patron is in their notices!

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Bug 33690: Tidy test

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 11:07:55 -04:00
David Cook 6a0955946e
Bug 30843: Add mfa_range configuration option for TOTP
This change adds a mfa_range configuration option for TOTP
to koha-conf.xml, and overrides the "verify" method from
Auth::GoogleAuth in order to provide a new default for "range"

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=TwoFactorAuthentication
3. Change the syspref to "Enable"
4. Go to
http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51
5. Click "More" and "Manage two-factor authentication"
6. Register using an app
7. In an Incognito window, go to
http://localhost:8081/cgi-bin/koha/mainpage.pl
8. Sign in with the "koha" user
9. Note down a code from your Authenticator app
10. Wait until after 60 seconds and try it
11. Note it says "Invalid two-factor code"
12. Try a new code from the app
13. Note that it works

14. Add <mfa_range>10</mfa_range> to /etc/koha/sites/kohadev/koha-conf.xml
15. Clear memcached and koha-plack --restart kohadev
16. Sign in with the "koha" user
17. Note down a code from your Authenticator app
18. Wait 4 minutes and then try it
19. Note that it works

20. Disable your two-factor authentication and click to re-enable it
21. Use a code older than 60 seconds when registering for the two
factor authentication
22. Note that the code works

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 10:53:51 -03:00
Jonathan Druart fa28d2a17c
Bug 32496: Some fixes
This can be squashed

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-22 10:52:40 -03:00
Arthur Suzuki 40ca7aa06c
Bug 32942: (QA follow-up) Moving Suggestion->STATUS check to Suggestion::store
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-18 15:31:45 -03:00
Kyle M Hall e0b3a6c2aa
Bug 34731: Don't call SendQueuedMessages if message_id is bad
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-12 09:44:59 -03:00
Marcel de Rooy 6f5915cf01
Bug 34339: (QA follow-up) Replace new by search in Licenses
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-08 11:54:51 -03:00
Jonathan Druart dd8b3c3da7
Bug 34339: Avoid relying on $c->validation - ERM
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-08 11:54:50 -03:00
Tomas Cohen Arazi 5788f94868
Bug 34339: (bug 33556 follow-up) Easy ERM-related changes
I left the (easy) ERM cases out because it throws this when running the
QA script:

Processing files before patches
|========================>| 51 / 51 (100.00%)

An error occurred : Inconsistent hierarchy during C3 merge of class 'Koha::REST::V1::ERM::EHoldings::Titles::Local':
	current merge results [
		Koha::REST::V1::ERM::EHoldings::Titles::Local,
	]
	merging failed on 'Mojolicious::Controller' at /kohadevbox/qa-test-tools/koha-qa.pl line 112.

and didn't want this to pollute the rest of the changes.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-08 11:54:49 -03:00
Tomas Cohen Arazi 749783debf
Bug 34313: Add patron information in pass validation response
This patch makes the password validation response return the following
patron attributes to the API consumer:

* cardnumber
* userid

This will give hints on what was used to validate in the fallback
bahvior the endpoint has.

To test:
1. Apply the unit tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/password_validation.t
=> FAIL: The endpoint doesn't return this valuable data
3. Apply this patch
4. Repeat 2
=> SUCESS: Tests pass! We got the cardnumber and the userid!
5. Sign off :-D

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-08-29 14:59:02 -03:00
Tomas Cohen Arazi a05dff84eb
Bug 34024: (QA follow-up) Allow pickup location changing for in transit holds
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-08-18 10:29:25 +03:00
Tomas Cohen Arazi a1b5bd9534
Bug 34024: Block changing pickup location for found holds
This patch adds a check on holds for 'found' statuses. Holds with the
following statuses have special workflows in Koha, and overwritting
their pickup locations yields uncertain scenarios:

* Waiting: the item has probably been put on a special shelve
* In transit: the item is travelling to a new destination, and changing
  the pickup location should include some validations, and probably
  generate some notifications. At least.
* In processing: the item has already been taken out of the shelve for
  some internal processing. Changing the pickup location could interfere
  with this workflow. Overriding this limitation could be introduced
  with care on a separate report.

To test:
1. Apply the unit tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/holds.t
=> FAIL: Tests don't pass. Holds go through (200) instead of being
rejected (409).
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-08-18 10:29:23 +03:00
Tomas Cohen Arazi eb224540e2
Bug 34365: Add cancellation request flow to DELETE /holds
This patch adds a new `x-koha-override` header to allow enforcing the
cancellation request flow for waiting holds.

If the hold is not waiting, the header has no effect.

To test:
1. Apply the tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/holds.t
=> FAIL: The endpoint doesn't implement the required logic
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass! The endpoint behavior is changed!
5. Sign off :-D

Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-08-15 11:25:54 +03:00
Martin Renvoize 3c90dbcb82
Bug 32739: (follow-up) QA Cleanup
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-25 16:25:37 -03:00
Tomas Cohen Arazi 69653a281d
Bug 32739: Allow other patron identifier on pwd validation
This patch takes a step forward on the password validation endpoint, by
adding  the `identifier` parameter and making it be allowed
to be the patron's `cardnumber` or the `userid`.

The current `userid` only validation option is kept as-is.

The implementation relies on `C4::Auth::checkpw` to query for the
patron.

To test:
1. Apply this patches
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/password_validation.t
=> SUCCESS: Tests pass!
3. Sign off :-D

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-25 16:25:37 -03:00
Tomas Cohen Arazi 95af4c9de1
Bug 33556: Avoid relying on $c->validation
Talking to the OpenAPI plugin maintainer, he mentioned the use of $c->validation->output should be avoided as the plugin is not designed to have a stable behavior there, and he even thought of just removing the method.

That method returns an internal data structure the plugin uses to validate things, and then updates the request itself.

Take the following example:

GET /patrons/123
x-koha-embed: checkouts,library

without the OpenAPI plugin, requesting the header like this:

$c->req->headers->header('x-koha-embed')

would return a scalar, the string 'checkouts,library'.

When using the plugin, and with `x-koha-embed` being defined as collectionFormat: csv, that header is entirely replaced by an arrayref.

That's how the plugin works and how it is expected to be used. So we need to replace the uses of $c->validation format, with normal Mojo usage to avoid future headaches.

This patch changes:
* $c->validation->param => $c->param
* $c->validation->param('body') => $c->req->json

To test:
1. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/*.t
=> SUCCESS: Tests pass!
2. Apply this patches
3. Repeat 1
=> SUCCESS: Tests still pass!
4. Sign off :-D

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-21 17:14:37 -03:00
Tomas Cohen Arazi dcbd3e6929
Bug 33556: Path parameters are handled explicitly in the controllers
In the case of $c->objects->search_rs, the variable is just not used.
In the case of /acq/orders, it's a leftover from when we removed in the
helper. Check there are tests with path params everywhere (including
orders) and it has no effect.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-21 17:14:36 -03:00
Tomas Cohen Arazi e8c5c0360a
Bug 33105: Avoid using $c->validation
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-20 10:59:33 -03:00
Tomas Cohen Arazi 5ba8a8510a
Bug 33105: Tidy files
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-20 10:59:31 -03:00
Jonathan Druart 3ead2ab623
Bug 33105: Add tests
Signed-off-by: Jonathan Field <jonathan.fieeld@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-20 10:59:25 -03:00
Nick Clemens 7afbba200d
Bug 33444: Update AddRenewal to take a hashref of params
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Removed skip_record_index => 1 from automatic_renewals.pl. See BZ.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-19 12:06:52 -03:00
Tomas Cohen Arazi d0ef15717f
Bug 30979: Fix regression
This patch fixes a regression introduced by the 'Fix public availability
500' follow-up.

To test:
1. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/checkouts.t
=> FAIL: Tests fail!
2. Apply this patch
3. Repeat 1
=> SUCCESS: Tests pass! Tests are useful!
4. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-14 12:14:48 -03:00
Martin Renvoize 96bbd70d2d
Bug 30979: (follow-up) Fix public availability 500
When we introduced the logged in user id to the token generation we
had the knock on effect of creating a 500 response for unauthenticated
availability lookups.

This patch resolves the 500, but results in a token that's not useful
for the end user.  We should consider this in the wider context down the
line.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-14 12:14:45 -03:00
Martin Renvoize bc55051e49
Bug 30979: Limit public checkout endpoint using preference
The public api endpoint for self-checkout should only be enabled in the
case where the OpacTrustedSelfCheckout option is enabled.

Signed-off-by: Silvia Meakins <smeakins@eso.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-14 12:14:41 -03:00
Martin Renvoize 959794e1cb
Bug 30979: Add public endpoints
This patch expands the checkouts endpoints to allow for a public workflow.

We add the availability endpoint under `/public/checkouts/availability`
and restrict the information we send back to only those fields a public
user should be allowed to see.

We also add a new checkout endpoint at `/patrons/{patron_id}/checkouts`
that allows for users to checkout to themselves and accepts the same POST
request with checkout details including item_id and a confirmation token
in the body that the staff client endpoints accept.

Signed-off-by: Silvia Meakins <smeakins@eso.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-14 12:14:39 -03:00
Tomas Cohen Arazi 927c5a8913
Bug 33817: (QA follow-up) Fix tidyness
This patch fixes some reported tidyness issues with the patches.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-10 15:43:10 -03:00
Jonathan Druart 384de4a74a
Bug 33817: Enforce server-side
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-10 15:43:09 -03:00
Tomas Cohen Arazi d90d264253
Bug 33974: (follow-up) _order_by is not always an arrayref
The loop through the `_order_by` query parameter occurences introduced
by this patchset was naive regarding the possible scenarios.

When there's only one parameter passed, it shouldn't be expecting an
arrayref, but a scalar. This patch deals with that in the simplest way.

To test:
1. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/REST/Plugin/Objects.t
=> FAIL: Tests are failing
2. Apply this patch
3. Repeat 1
=> SUCCESS: Tests pass!
4. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-06 15:55:06 -03:00
Marcel de Rooy 251aef431b
Bug 33606: (QA follow-up) Cosmetic changes
Even the POD name wasnt changed after copying :)

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-06 12:24:15 -03:00
Jonathan Druart feeb288e30
Bug 33606: Add a erm/config route to retrieve the ERM config needed for the Vue app
This could be extended later in bug 32968 to pass the permission of the
logged in user.

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-06 12:24:13 -03:00
Martin Renvoize c7be846243
Bug 33974: (QA follow-up) Remove superflous import
We don't actually need the Clone import.. it's not used in Biblios.pmt

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 14:51:44 -03:00
Tomas Cohen Arazi c07e43cf2a
Bug 33974: (follow-up) Adapt the orders endpoint
In order to reduce the technical debt carried on the orders controller,
and to highlight the decisions made on the prior patch, I adapted the
list() orders controller using the new tools in town.

The result is this endpoint can now embed bibio, without needing to have
a custom piece of code.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/*.t
=> SUCCESS: Tests pass :-D

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 14:51:44 -03:00
Tomas Cohen Arazi 353f328ad3
Bug 33974: Make biblioitem columns searchable in a generic way
This patch makes biblioitem attributes be searchable on the biblios
endpoint. It does so by using the new method in Koha::Biblios, and by
adjusting objects.search(_rs) to accept a $query_fixer arrayref of
functions to be applied to each query or order_by parameters.

The result is cleaner code to write, but complex internals.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/biblios.t
=> SUCCESS: Tests pass! Searching for biblioitem attributes works on the
API!
3. Sign off :-D

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 14:51:43 -03:00
Tomas Cohen Arazi 252753f84f
Bug 33573: Add public endpoint for cancelling holds
This patch introduces a public endpoint for cancelling holds.
Cancellation requests are generated when the hold is waiting and
configuration allows requesting cancellation, as the OPAC does right
now.

Tests cover all the use cases.

To test:
1. Apply this patches
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/patrons_holds.t
=> SUCCESS: Tests pass!
3. Sign off :-D

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 14:51:31 -03:00
Tomas Cohen Arazi 3fc1f27524
Bug 33971: Remove x-koha-query header support
This patch removes support for the `x-koha-query` header entirely from
the codebase. For the purpose:

- $c->objects->search is adjusted
- Relevant tests are cleared/adapted
- The OpenAPI spec gets the header removed

To test:
1. Apply this patch and run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/REST/Plugin/Objects.t \
           t/Koha/REST/Plugin/Query.t \
           t/db_dependent/api/v1/*.t
=> SUCCESS: Tests pass!
2. Sign off :-D

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 10:35:06 -03:00
Tomas Cohen Arazi f32fe0d39c
Bug 33971: Remove x-koha-query handing in Orders.pm
This patch removes manual handling of `x-koha-query` in the
Orders:list() controller.

There are no tests for the feature but you can verify no behavior is
changed by doing:

1. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/acquisitions_orders.t
=> SUCCESS: Tests pass
2. Apply this patch
3. Repeat 1
=> SUCCESS: Tests pass
4. Sign off :-D

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 10:35:06 -03:00
Tomas Cohen Arazi 871a96552e
Bug 23336: (QA follow-up) Minor fixes
There are two leftover includes, and a couple typos in a comment and POD
title.

This patch fixes that.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 10:35:02 -03:00
Martin Renvoize 918bdd435d
Bug 23336: (QA follow-up) Minor fixes
This patch deals with some QA script warnings, and also makes some
changes in line with bug 33556.

We also adds current user id and checkout item id into the confirmation
token to improve security and fix the failing tests.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 10:35:01 -03:00
Martin Renvoize c5a304b4ca
Bug 23336: (follow-up) Switch to using Koha::Token
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 10:35:00 -03:00
Martin Renvoize 6db025bd9d
Bug 23336: Add checkout API's
This patch adds API's to allow for a checkout flow using the RESTful
API.

We add an availability endpoint to check an items current availability
status. The endpoint can be found at `/checkouts/availability` and is
a GET request that requires item_id and patron_id passed as parameters.

We return an availability object that includes blockers, confirms,
warnings and a confirmation token to be used for checkout.

We also add a corresponding checkout method to the `/checkouts` endpoint.
The method accepts a POST request with checkout details including item_id
, patron_id and the confirmation token in the body.

Future work: We should properly migrate CanBookBeIssued into Koha::* and
use that here instead of refering to C4::Circulation.

Signed-off-by: Silvia Meakins <smeakins@eso.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-03 10:34:59 -03:00
Lucas Gass df4285adb2
Bug 33176: Enforce RequirePaymentType with API
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-06-12 11:52:06 -03:00
Jonathan Druart deeb5ebdbd
Bug 33904: Fix 2FA registration when library name has non-latin characters
If the library name contains non-latin characters, the 2FA registration
process will fail with a JS alert coming from a 500 server-side.

The problem is that Auth::GoogleAuth is expecting an already UTF8 encoded string.
We should set the encoding correctly to make Auth::GoogleAuth deal with
the URL escaping internally correctly, then decode on our own (in the
REST API controller)

Test plan:
* Modify your logged in library name and add some non-latin characters
(eg. "my ❤ library")
* Turn on TwoFactorAuthentication
* Go to your account > More > Manage 2FA
* Click the enable button
=> Notice that you see the QR code and that both "issuer" and "key id"
entries display the library name correctly.
* Test the whole 2FA process, confirm that the library name is correctly
displayed on the app you are using.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-06-09 08:28:58 -03:00
Owen Leonard 78f1bfaccf
Bug 33859: Use the phrase 'Identity providers' instead of 'Authentication providers'
This patch updates instances in the code and templates where the term
"Authentication providers" is used, replacing it with the preferred
"Identity provider."

Most of the instances of this change are in module or API documentation,
but you can see a couple of the changes in the interface:

- Administration -> Identity providers:
  - The sidebar menu should show "Identity providers" instead of
    "Authentication providers."
- Patrons -> Patron details -> More -> Set permissions
  - Under " Manage Koha system settings (Administration panel)" you
    should see "Manage identity providers (manage_identity_providers)"

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-06-05 14:36:03 -03:00
Tomas Cohen Arazi c84f06ec62
Bug 33854: Fix typo in ImportBatchProfiles controller
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-30 08:05:32 -03:00
Tomas Cohen Arazi 5d191f21e5
Bug 33675: Add CSRF protection to OAuth/OIDC authentication
This patch makes the OAuth/OIDC client pass a `state` parameter with a
CSRF protection token, to be validated back when the flow returns to
Koha.

Ideally, the Mojolicious::Plugin::OAuth2 library should deal with this
implicitly, probably making use of JWT. But as of now, this is the best
way to implement it.

To test:
1. Have a working SSO solution (ktd --sso)
2. Click to login using SSO
=> SUCCESS: Notice a 'state' parameter on the URL, looks like a random
thing
3. When you login, no error is reported

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-19 09:20:54 -03:00
David Cook 05190ed1d9
Bug 33708: Allow anonymous access to OAuth endpoints
Users needs anonymous access to OAuth endpoints so that they can
login, and then use authenticated access for other endpoints.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-18 11:35:16 -03:00
Tomas Cohen Arazi dd512db60b
Bug 33708: Make staff interface login not require public API (OAuth/OIDC)
This patch makes the URL for staff login not point to the `/public`
namespace. The behavior is not changed for the protocol, but as
`/public` requires several settings to be available, it effectively
requires to enable the OPAC, the public API, etc. This patch
diferentiates both to solve the problem.

I've tested following the Wiki instructions to set keycloak [1] using
the *--sso* switch for `ktd` as well [2].

It is important to set the following URLs as allowed redirect in order
to replicate the issue and verify the fix:

http://localhost:8080/api/v1/public/oauth/login/test/opac
http://localhost:8081/api/v1/oauth/login/test/staff

To test:
1. Login into the staff interface using the SSO link:
=> FAIL: Results in a 'Bad redirect URL' error
2. Apply this patch and repeat 1
=> SUCCESS: You get a permission denied error or you just login,
depending on your setup.

[1] https://wiki.koha-community.org/wiki/Testing_SSO
[2] ktd --sso up -d

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-18 11:35:15 -03:00
Agustin Moyano a551cb47ea
Bug 8179: Receive multiple orders
This patch implements the code to allow a patron to receive multiple
orders at the same time in /cgi-bin/koha/acqui/orderreceive.pl page

To test:
1. apply all patches
2. updatedatabase
3. Go to system preferences and allow AcqReceiveMultipleOrderLines
4. In acquisitions module, create a vendor if you don't have one and add
   3 baskets.. one with create items on ordering, one with create items
   on receiving and finally one with create items when cataloguing
5. Fill baskets with orders (There should be at least 15 orders in total). There should be a mix of orders created by suggestions, others by subscriptions and others by neither of those methods.
6. Close all baskets and receive shipment.
CHECK => in /cgi-bin/koha/acqui/parcel.pl page, in top table there is a column with checkboxes, and a button that says "Receive selected"
7. If all orders from all baskets are shown in the table, set the rows per page to 10, so table has more than one page
8. Check some of the checkboxes
CHECK => "Receive selected" button shows how many rows are selected
9. Go to the next page and select some more rows
CHECK => Changing page does not modify how many rows where selected
10. Go back to previous page
CHECK => Previously selected rows are still selected
11. Reload the page to deselect all rows
12. Select only one row and click on "Receive selected" button
CHECK => the page /cgi-bin/koha/acqui/orderreceive.pl behaves just the same as if the "receive" link in the selected row would have been clicked.
13. Click on cancel to go back to parcel.pl page
14. Select all rows (even the ones from the next page of the table) and
    click on "Receive selected"
CHECH => In orderreceive.pl page there is a table with all selected rows
15. Ensure table has more than one page, as in step 7
16. Click on the "edit" link in the last row of the current page
CHECK => A modal window is displayed with 4 tabs within: Info,
Accounting, Receipt history and Items
CHECK => Modal has 4 buttons at the bottom, 'Previous' to go to previos
order, 'Cancel' to close the modal without keeping modifications, 'Save'
to close modal keeping modifications and 'Next' to go to the next order
CHECK => Even that we are at the end of the current page, 'Next' button
is still available
17. Click on 'Next' button
CHECK => The table behind the modal now displays the next page, and the modal was not closed
18. Click on 'Previous'
CHECK => The table behind the modal went back to the first page, and the modal was not closed
19. Click on 'Previous' button till you reach the first row of the first
    page
CHECK => Only when you reach the first row of the first page 'Previous'
button gets disabled
20. Click on 'Next' button till you reach the last row of the last page
CHECK => Only when you reach the last button of the last page 'Next'
button gets disabled
21. Check that behaviour for the different types of order are still the
    same
    a. For orders that where created through suggestion, check that the
suggestion info is present in Info tab. If when suggestion was accepted
you set a reason, a dropdown to change the reason shoul display also.
    b. For orders that where created through subscriptions, check that
the Items tab is disabled, and the Receipt history is enabled. On
accounting tab you should be able to change quantity ordered. If there
were less items received than ordered, the next time you receive this
order the child order generated from this one shoul appear in receipt
history.
    c. For orders that don't come from subscription and creates there items on ordering, Receipt history
should be disabled, and a table with prefilled items shold appear in the
Items tab. You can edit them and the changes should appear in the item's
row.
    d. For orders that don't come from subscription and creates there
items on receiving, Receipt history should be disabled, and a form to
create the items should appear in Items tab. When you add an item a
table should appear.
    e. For orders that don't come from subscription and creates there
ites on cataloguing, Receipt history and Items tabs should be disabled.
    f. Any changes made in quantity (received or ordered) or funds in the modal should be
reflected in the table if you click save from the modal.
22. Once you've done all you checking and verifications click save
23. While saving a progress bar should appear
24. If no error was detected, you should be redirected back to parcel.pl
    page
25. If an error or warning was detected (like there is an order with 0
    items to receive) the save button should be disabled and warnings
are dispayed.
26. prove t/db_dependent/Koha/Acquisition/Fund.t t/db_dependent/Koha/Acquisitoin/Order.t t/db_dependent/Koha/Item.t

Sponsored-by: Virginia Polytechnic Institute and State University
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-15 08:53:47 -03:00
David Gustafsson ddc2906b77
Bug 31735: Avoid re-fetcing objects from database by passing them directly instead of ids to various subroutines
To test:

1) Run the following test and make sure all pass:
  t/db_dependent/api/v1/biblios.t
  t/db_dependent/api/v1/checkouts.t
  t/db_dependent/api/v1/return_claims.t
  t/db_dependent/Circulation/CalcDateDue.t
  t/db_dependent/Circulation/CheckIfIssuedToPatron.t
  t/db_dependent/Circulation/dateexpiry.t
  t/db_dependent/Circulation/GetPendingOnSiteCheckouts.t
  t/db_dependent/Circulation/GetTopIssues.t
  t/db_dependent/Circulation_holdsqueue.t
  t/db_dependent/Circulation/IsItemIssued.t
  t/db_dependent/Circulation/issue.t
  t/db_dependent/Circulation/MarkIssueReturned.t
  t/db_dependent/Circulation/maxsuspensiondays.t
  t/db_dependent/Circulation/ReturnClaims.t
  t/db_dependent/Circulation/Returns.t
  t/db_dependent/Circulation/SwitchOnSiteCheckouts.t
  t/db_dependent/Circulation.t
  t/db_dependent/Circulation/TooMany.t
  t/db_dependent/Circulation/transferbook.t
  t/db_dependent/DecreaseLoanHighHolds.t
  t/db_dependent/Holds/DisallowHoldIfItemsAvailable.t
  t/db_dependent/HoldsQueue.t
  t/db_dependent/Holds/RevertWaitingStatus.t
  t/db_dependent/Illrequests.t
  t/db_dependent/ILSDI_Services.t
  t/db_dependent/Items.t
  t/db_dependent/Koha/Account/Line.t
  t/db_dependent/Koha/Acquisition/Order.t
  t/db_dependent/Koha/Biblio.t
  t/db_dependent/Koha/Holds.t
  t/db_dependent/Koha/Items.t
  t/db_dependent/Koha/Item.t
  t/db_dependent/Koha/Object.t
  t/db_dependent/Koha/Patrons.t
  t/db_dependent/Koha/Plugins/Circulation_hooks.t
  t/db_dependent/Koha/Pseudonymization.t
  t/db_dependent/Koha/Recalls.t
  t/db_dependent/Koha/Recall.t
  t/db_dependent/Koha/Template/Plugin/CirculationRules.t
  t/db_dependent/Letters/TemplateToolkit.t
  t/db_dependent/Members/GetAllIssues.t
  t/db_dependent/Members/IssueSlip.t
  t/db_dependent/Patron/Borrower_Discharge.t
  t/db_dependent/Patron/Borrower_PrevCheckout.t
  t/db_dependent/Reserves/GetReserveFee.t
  t/db_dependent/Reserves.t
  t/db_dependent/rollingloans.t
  t/db_dependent/selenium/regressions.t
  t/db_dependent/SIP/ILS.t
  t/db_dependent/Holds.t
  t/db_dependent/Holds/LocalHoldsPriority.t
  t/db_dependent/Holds/HoldFulfillmentPolicy.t
  t/db_dependent/Holds/HoldItemtypeLimit.t
  t/db_dependent/Circulation/transferbook.t
2) Performe one or more checkouts for a patron, making sure
  that the circulation rules allows for renewals (for example by
  setting an earlier due-date).
3) Log in as this patron in OPAC and make sure the list of
  checkouts is displayed correctly, and that renewing an issue
  still works.

Sponsored-by: Gothenburg University Library
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-12 12:40:21 -03:00
Tomas Cohen Arazi c1fe7406b9
Bug 33053: Handle invalid biblio_id more robustly
This patch addresses the fact the invalid FK error might differ under
some circumstances. We could try to catch the exception adding another
case, but I think this pattern is cleaner and the authors didn't provide
a fix.

We can discuss it later, as this controller class has several things to
review.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-11 16:56:08 -03:00
Agustin Moyano ead5f5c2f4
Bug 31799: (follow-up) Tidy up and fix duplicate barcode handling
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-09 10:57:56 -03:00
Agustin Moyano 51d50810fa
Bug 31799: Add REST endpoint to modify a biblio's item
To test:
1. Apply patch
2. Set RESTBasicAuth preference to true
3. Get a biblio with an item
4. Make a PUT request to /api/v1/biblios/:biblio_id/items/:item_id with a json body that represents an item to replace
5. Check that the item was modified
6. Sign off

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-09 10:57:55 -03:00
Kyle M Hall f03185edf5
Bug 31798: (QA follow-up) Remove use Koha::Item, we already use Koha::Items
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 17:45:18 -03:00
Nick Clemens 42c221cf1f
Bug 31798: (follow-up) Handle all values of autoBarcode
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 17:45:18 -03:00
Agustin Moyano 141c7cdf1a
Bug 31798: (follow-up) Tidy up and add duplicate barcode test
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 17:45:17 -03:00
Agustin Moyano a7c5b80d70
Bug 31798: Add REST endpoint to add a biblio's item
To test:
1. Apply patch
2. Set RESTBasicAuth preference to true
3. Get a biblio
4. Make a POST request to /api/v1/biblios/:biblio_id/items with a json body that represents the new item
5. Check that the item is created
6. Sign off

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 17:45:16 -03:00
Martin Renvoize a702f57adf
Bug 21043: Handle exceptions and switch to debit response
We were cheating a bit here and expecting a 'debit' to be sent in but a
'line' to be returned.

We should really be sending a debit and returning a debit.. so I've
update the paths schema as such and we're now coercing the
Koha::Account::Line object that's returned by Koha::Account->add_debit
into a Koha::Account::Debit object. Longer term it would be nice to
convert returns from the various Koha::Account methods to their correct
Koha::Account:: objects as apposed to them all being the base ::Line

I've also added some code to catch exceptions that can be thrown by
Koha::Account->add_debit and added the appropriate 400 errors into the
path specs again.

Finally.. I added more unit tests to prove the above

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 12:13:52 -03:00
Agustin Moyano ab10759c50
Bug 21043: Add debit REST endpoint
This patch adds an endpoint to create a debit for a patron.

Testplan

1. Create a new account debit type (Administration > Debit types)
2. Add a fee with this debit type to a patron’s account via API
3. Make sure that this fee is shown in the accounting overview in the patron’s account in the staff interface
4. Make sure that it is possible to make a payment for this fee

Sponsored-by: The Research University in the Helmholtz Association (KIT)
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 12:13:51 -03:00
Martin Renvoize f4c6a5dfd5
Bug 29453: Add endpoints for fetching patron credits & debits
This patch adds two new API endpoints for fetching a patrons credits and
a patrons debits.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Agustin Moyano <agustinmoyano@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 12:13:50 -03:00
Agustin Moyano 67cafa719b
Bug 32735: Add endpoint to list authorities
This patch adds an endpoint to list authorities

To test:
1. apply patch
2. enable basic auth
3. call to GET /api/v1/authorities with the following Accept headers:
 * application/json
 * application/marcxml+xml
 * application/marc-in-json
 * application/marc
 * text/plain
4. notice how data changes with each Accept header
5. prove t/db_dependent/api/v1/authorities.t
6. sign off

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 12:13:49 -03:00
Agustin Moyano b2801da206
Bug 31796: Add REST endpoint to modify an authority
To test:
1. Apply patch
2. Set RESTBasicAuth preference to true
3. Pick an authority to modify, and modify it's marc record
4. Make a PUT request to /api/v1/authorities/:authid with one of the following content type header
  - application/json
  - application/marcxml+xml
  - application/marc-in-json
  - application/marc
5. If content type is other than 'application/json' place the following header in the request 'x-authority-type: <auth type>'
5. Check that the authority was modified
6. Sign off

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 12:13:44 -03:00
Tomas Cohen Arazi bdc2deba99
Bug 31795: (follow-up) Mock call to FindDuplicateAuthority
When running against Zebra, this tests fail because it requires the
record to be indexed timely. In theory, a 5 seconds delay should be
enough for the indexer to pick up. But that's not the point of the test,
and we should better just mock the query in this case.

To test:
1. Have ktd launch with zebra:
   $ ktd up -d
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/authorities.t
=> FAIL: Tests fail!
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Launch ktd with ES:
   $ ktd down
   $ ktd --es7 up -d
6. Repeat 2
=> SUCCESS: Tests pass!
7. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 10:18:44 -03:00
Tomas Cohen Arazi 531d03e811
Bug 31795: (QA follow-up) Use x-koha-override header
Despite its title, this patch does a couple more things.

1. The tests are rewritten to cover more things, and also to avoid
   deleting all authorities inside the transaction. It is really not
   required.
2. It makes the endpoint rely on the already generically implemented
   x-koha-override header, which is intended for the same use case as
   x-confirm-not-duplicate is for.
3. It changes the return codes to match the coding guidelines [1]
4. Only checks for duplicates if no override passed.

To test:
1. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/authorities.t
=> SUCCESS: Tests pass!
2. Apply this follow-up
3. Repeat 1
=> SUCCESS: Tests pass!
4. Sign off :-D

[1] https://wiki.koha-community.org/wiki/Coding_Guidelines_-_API#SWAGGER3.2.1_POST

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 10:18:43 -03:00
Agustin Moyano 1cbe4c2e41
Bug 31795: Add REST endpoint to add an authority
To test:
1. Apply patch
2. Set RESTBasicAuth preference to true
3. Make a POST request to /api/v1/authorities with one of the following content type header
  - application/json
  - application/marcxml+xml
  - application/marc-in-json
  - application/marc
4. If content type is other than application/json, then add the following header to the request: "x-authority-type: <auth type code>"
5. Check that the authority is created
6. Sign off

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 10:18:43 -03:00
Nick Clemens e3c31212df
Bug 33470: Don't calculate overridden hold limits
This patch can largely be checked in the code to ensure it makes sense, it
moves a conditional up one level for the two different checks that could prevent holds

To test:
1 - Attempt to place a hold via the REST API with an invalid pickup location
    Set pickup location as no in branches to make this easy
2 - Confirm you get an error
3 - Attempt again with header (bug 27760):
    x-koha-override: any
4 - Hold is placed
5 - Repeat 1-4 above but with an item that cannot be held
6 - Apply patch
7 - Repeat 1-4 above
8 - Results should be the same

Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 10:18:37 -03:00
Pedro Amorim 50909d2266
Bug 22440: Move backend statuses api endpoint
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 09:13:43 -03:00
Pedro Amorim 313ce33b22
Bug 22440: ILL API changes
* Add GET /illbackends/{id}/statuses
* Change API route to ill/requests

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 09:13:42 -03:00
Tomas Cohen Arazi 1a186826e4
Bug 22440: Add Koha::Illrequests->filter_by_visible
This patch introduces a method for filtering out requests that match the
statuses specified on the *ILLHiddenRequestStatuses* system preference.

To test:
1. Apply this patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/Koha/Illrequests.t
=> SUCCESS: Tests pass!
3. Sign off :-D

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 09:13:40 -03:00
Tomas Cohen Arazi 00629fe94f
Bug 33328: Rename x-marc-schema => x-record-schema
This patch renames the header on the biblio API so it is not entirely
tied to MARC, trying to follow the biblio_metadata table generic
approach.

To test:
1. Apply this patch
2. Run:
   $ prove t/db_dependent/api/v1/biblios.t
=> SUCCESS: Tests pass
3. You agree with the change?
4. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Change sounds reasonable. Tests pass before and after patch.
"grep -r "x-marc-schema" *" confirms no occurrences after patch.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 09:13:24 -03:00
Jonathan Druart af34d97928
Bug 33482: Propagate errors from EBSCO's ws to the UI
When adding or removing eholdings from EBSCO, if an error happens it is
lost and not propagated to the UI.

We were missing a return in the logic, and always returning 200

Test plan:
Do not apply (or revert) bug 33481
Configure EBSCO for ERM and add a package to your holdings
With this patch applied you will get a 500 that is propagated to the UI
Without this patch nothing happens and the user is not aware that
something bad happened

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-05-05 09:13:18 -03:00
Pedro Amorim aaa5bcd16b
Bug 28641: ILLHiddenRequestStatuses does not consider custom statuses
This patch adds the status_alias column to the ILLHiddenRequestStatuses sys pref check.
Because requests will have status_alias NULL by default, we also check for that.

Test plan:
Create multiple ILL requests of different backends and place them in different status (NEW, COMP, REQ, etc)
Create multiple ILLSTATUS entries
Add and remove a mix of both status and status_alias codes in ILLHiddenRequestStatuses and refresh the ILL requests page to confirm the result is according to expectation.

Sponsored-by: PTFS Europe

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-03-31 12:28:14 +02:00
Martin Renvoize b0a570796c
Bug 33146: Add public items lookup route
This patch adds a /public equivilent to the item listing endpoint.

This allows us to search for an item by it's external_id (barcode).

Test plan
1. Apply patch
2. Perform a GET on /api/v1/public/items?external_id=some_barcode
3. Confirm that the above endpoint correctly returns items that should
   be visible in the OPAC

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Bug 33146: (QA follow-up) Do not delete all items in test

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Bug 33146: Allow embedding expanded coded values

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Bug 33146: (QA follow-up) Consistency with /biblios/:biblio_id/items

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Bug 33146: (QA follow-up) Make sure public API enabled for tests

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-03-31 12:26:57 +02:00
Tomas Cohen Arazi 075ef09f48
Bug 32336: (QA follow-up) Use $metadata->schema
When we worked on Koha::Biblio::Metadata, we agreed
biblio_metadata.schema would be the sourceof truth when it comes to the
record schema.

This patch acknowledges that, while retaining the fallback to the
syspref.

To test:
1. Apply this patch
2. Run:
   $ prove t/db_dependent/api/v1/biblios.t
=> SUCCESS: Tests pass, behavior is unchanged.
3. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-03-31 11:56:48 +02:00
Julian Maurice 1a02ba56f1
Bug 32336: Fix encoding of MARCXML output for REST API (UNIMARC)
Test plan:
1. Be sure to test on a UNIMARC instance
2. Enable system preferences RESTPublicAPI and RESTPublicAnonymousRequests
3. Create a biblio with some diacritics
4. Restart koha and do not interact with OPAC or the staff interface
   (this may change $MARC::File::XML::RecordFormat)
5. Query the public API to retrieve the created biblio in MARCXML. For
   instance with cURL:

   curl -H 'Accept: application/marcxml+xml' \
    http://koha.local/api/v1/public/biblios/<biblionumber>

   You should see encoding issues.
6. Apply the patch and restart Koha.
7. Repeat step 5.
   You should see no encoding issues.
8. You should also test /api/v1/biblios/<biblionumber> (this one
   requires authentication, so cURL might not be the most practical
   tool; use your favorite tool for this)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-03-31 11:56:47 +02:00
Marcel de Rooy e96f32b29c
Bug 32426: (follow-up) Fix api/v1/patrons.t
We use another exception now.

Test plan:
Run t/db_dependent/api/v1/patrons.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-03-28 14:54:04 +02:00
Julian Maurice 6561cd84b6
Bug 33021: Show an alert when adding a reserved item to an item bundle
Test plan:
1. Create an item bundle (see bug 28854 comment 458)
2. Create a biblio with one item and place a hold for this item.
3. Try to add the reserved item to the bundle
   You should see a message saying that the item is reserved. Next to
   this message should be a button "Ignore holds and add to bundle".
4. Click on the button. There should be a message saying that the item
   was added to the bundle.
5. Close the modal window and verify that the item was correctly
   added to the bundle

Signed-off-by: Lucas Gass <lucas@bywatersolutiosn.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-03-27 12:50:05 +02:00
Martin Renvoize f04dd671af
Bug 32121: (QA follow-up) Use error_code rather than key
We semi-recently introduced error_code into our error object to allow
for translation and code paths for different errors without having to
rely on long description string matches.

This QA follow-up converts the existing match and new 'key' fields
introduced in this patchset to use the updated 'error_code' key.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-03-27 12:50:03 +02:00
Julian Maurice de36244266
Bug 32121: Show an alert when adding a checked out item to an item bundle
When trying to add a checked out item to an item bundle, an alert
message will show up, giving the user a chance to return the item
immediately before adding it to the bundle

Test plan:
1. Create an item bundle (see bug 28854 comment 458)
2. Create a biblio with one item and check out this item.
3. Try to add the checked out item to the bundle
   You should see a message saying that the item is checked out. Next to
   this message should be a button "Check in and add to bundle".
4. Click on the button. There should be a message saying that the item
   was added to the bundle.
5. Close the modal window and verify that the item was correctly
   returned and added to the bundle

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-03-27 12:50:02 +02:00
Tomas Cohen Arazi 185b431ebf
Bug 33227: Remove invalid spec and adjust the code accordingly
The spec contains a non-standard definition for the body param. Removing
it from the spec makes us need to handle the 'body' manually in the case
of JSON data.

This patch basically does that. It also changes the uses of
$c->validation, which are discouraged by the
Mojolicious::Plugin::OpenAPI dev/maintainer. I do it to highlight what
we must do in other places and the fact that there's no behavior change.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/biblios.t \
           xt/api.t
=> SUCCESS: Tests pass!
3. Sign off :-D

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-03-20 09:39:50 -03:00
Martin Renvoize 33de3ef9dc
Bug 32713: Throw exception on unexpected x-koha-embed header
This patch adds an exception to stash_embed that is thrown when we
find an x-koha-embed header that we're not expecting.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-03-16 16:12:31 -03:00
Martin Renvoize 64d3498da4
Bug 32118: Add optional support for `:` as the modifier
This patch adds optional support for using `:` as the modifier for
invoking the 'count' method for relations as discussed.

We retain support for `+` for backward compatability to prevent a
breaking change.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-03-14 08:49:27 -03:00