Commit Graph

872 Commits

Author SHA1 Message Date
Pedro Amorim 09673df356
Bug 40550: Add cancellation_bulk API endpoint
Signed-off-by: Phillip Berg <phillip.berg@mainlib.org>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-11-03 14:13:29 -07:00
Lucas Gass 7818111a64
Bug 40517: (follow-up) Fix GNU license links
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-10-29 11:50:12 -06:00
Pedro Amorim dada9dad0f
Bug 40517: REST API: Hold groups endpoint
list and add actions:
/patrons/{patron_id}/hold_groups

New test file:
prove t/db_dependent/api/v1/patrons_hold_groups.t

Signed-off-by: Anneli <anneli.osterman@koha-suomi.fi>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-10-29 11:50:08 -06:00
Martin Renvoize 05aa74e921
Bug 39336: Public Biblio endpoint should honour OpacSuppression syspref
This patch makes the Public Biblio endpoint respect the OpacSuppression
system preference and the biblio.opac_suppressed field introduced in
Bug 38330.

When OpacSuppression is enabled and a biblio has opac_suppressed set to 1,
the endpoint now returns a 404 (Not Found) response instead of exposing
the bibliographic record.

Test plan:
1. Apply patch
2. Run: prove t/db_dependent/api/v1/biblios.t
3. Verify all tests pass, including the new OpacSuppression subtest
4. Test manually:
   - Enable OpacSuppression syspref
   - Set a biblio's opac_suppressed field to 1
   - Access /api/v1/public/biblios/{biblio_id}
   - Confirm it returns 404
   - Set opac_suppressed to 0
   - Confirm it returns 200 with the record
   - Disable OpacSuppression syspref
   - Confirm record is visible regardless of opac_suppressed value

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-10-24 07:57:00 -06:00
Tomas Cohen Arazi 83a823aec5
Bug 38931: Add endpoints for individual credits and debits
As the title says, we are missing such endpoints and this patch adds
them.

To test:
1. Apply this patches
2. Run:
   $ ktd --shell
  k$ yarn api:bundle
  k$ prove t/db_dependent/api/v1/patrons_accounts.t
=> SUCCESS: The spec builds!
=> SUCCESS: The tests pass!
3. Verify all the codepaths are covered by tests
4. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-10-14 14:51:59 -06:00
Nick Clemens c1fa513be9
Bug 39408: Don't attempt to send a message if one is not generated
The routine to create the message can return nothing if there is no content,
we should handle this case and not attempt to send.

To test:
1 - Test plan from last patch
2 - Apply this patch
3 - POST to patron API again
4 - Success!

Signed-off-by: Claire Hernandez <claire.hernandez@biblibre.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-10-14 14:51:55 -06:00
Nick Clemens ae14a11937
Bug 39408: Handle BadParameter exception better
Currently we assume BadParameter has been thrown with a parameter that is a valid patron field.
It may only include a message, or it may have come from outside the patron object, we should
handle all cases.

To test:
1 - Wrap "WELCOME" notice content in conditional:
    [% IF borrower.categorycode != 'SELFREG' %]
    ...
    [% END %]
2 - Enable preference AutoEmailNewUser
3 - Attempt to self register a patron via API with body:
    {"surname":"PATRON","firstname":"PROBLEM","library_id":"CPL","category_id":"SELFREG","email":"eample@example.org"}
4 - Response error: "Given  does not exist"
5 - Apply this patch, restart all
6 - Repeat 3
7 - Response error: "Exception 'Koha::Exceptions::BadParameter' thrown 'Parameter message_id cannot be empty if passed.'\n"
8 - It's uglier, but actually helpful

Signed-off-by: Claire Hernandez <claire.hernandez@biblibre.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-10-14 14:51:54 -06:00
David Cook c53fdd3623
Bug 34164: Redirect to referring URL when doing OIDC/OAuth SSO
This patch makes it so that a successful SSO will return you to
the place where you initiated the SSO. This is especially useful
when doing searches, placing holds, etc.

Test plan:
0. Apply patch and koha-plack --restart kohadev
1. Set up OIDC SSO using
https://wiki.koha-community.org/wiki/Testing_SSO
2. Go to http://localhost:8081/cgi-bin/koha/circ/circulation-home.pl
3. Do a staff login using SSO
4. Note that you're redirected to
http://localhost:8081/cgi-bin/koha/circ/circulation-home.pl
after the successful login

5. Go to http://localhost:8080/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1
6. Do a OPAC SSO login
7. Note that you're returned to
http://localhost:8080/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1
after the successful login

8. Logout of the staff admin and OPAC
9. Note your URL ends in ?logout.x=1
10. Try logging back into them using SSO
11a. Note that you're logged in and not automatically logged out
11b. Note that if you're on the OPAC, you should be redirected
to opac-user.pl instead of opac-main.pl or the root path

12. If you change the domain for the SSO users to something
that your user does not match, try logging in again, and note
that the error message should display on mainpage.pl or opac-main.pl/opac-user.pl
for the OPAC. (This is because these are the pages that show SSO errors.)

Signed-off-by: Lukas Koszyk <lukasz.koszyk@kit.edu>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-10-09 14:58:40 -06:00
Martin Renvoize 1884f68c5b
Bug 40866: Implement Alternative pattern for holds override logging (Part 4)
This patch implements proper override logging for holds following the
Alternative implementation pattern used for checkouts and renewals.

Instead of just removing the orphaned logging code from the original
Bug 9762 implementation, this patch properly implements override logging
by updating AddReserve to accept and log override information, similar
to how AddIssue handles confirmations and forced overrides.

Changes:

C4/Reserves.pm:
- Added JSON qw(to_json) import
- Updated AddReserve to accept confirmations and forced parameters
- Enhanced the existing logaction call to include override information
  in JSON format when overrides are present
- Log format matches the Alternative implementation pattern:
  * hold ID
  * branchcode
  * biblionumber
  * itemnumber
  * confirmations array
  * forced array

Koha/REST/V1/Holds.pm:
- Added confirmations array building in the add() method
- Pass 'HOLD_POLICY_OVERRIDE' confirmation when override_all is true
- Pass confirmations parameter to AddReserve call

reserve/request.pl:
- Removed orphaned original implementation logging code
- Removed unused variables and imports (message, @message, user, etc.)
- Removed C4::Log import

koha-tmpl/intranet-tmpl/prog/en/includes/action-logs.inc:
- Added 'HOLD_POLICY_OVERRIDE' case to translate_log_override block
- Displays as "Hold policy override" in log viewer

koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt:
- Added JSON display handling for HOLDS module (similar to CIRCULATION)
- Displays hold ID, biblionumber, and optional itemnumber with links
- Shows forced and confirmation overrides using translate_log_override

This ensures hold overrides are logged consistently with the Alternative
implementation pattern, providing proper audit trails for policy overrides
that are properly displayed in the log viewer.

Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-10-09 14:58:34 -06:00
Matt Blenkinsop 23fe21df61
Bug 40868: Restore full list of permissions to the vendors app
This patch adjusts the logic to consider all permissions and not just the top level flags

Test plan:
1) Create or edit a user to have all acquisitions permissions except one (not relevant which one, any will do)
2) Log into the staff interface and go to acquisitions > vendors and click the vendor in the table
3) The left menu will be missing everything except invoices
4) Apply patch and restart_all
5) Refresh the page, the menu should now be populated

Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:28 -06:00
Jonathan Druart 1a2a7e4619
Bug 37622: Remove location from 2 preservation 'update' routes
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:53 -06:00
Jonathan Druart 9e8b9f607a
Bug 37622: Fix add_debit
We should not call discard_changes after accessing ->id but before

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:52 -06:00
Hammat Wele ddbd11cbad
Bug 37622: Error in erm module when editing an agreement, a license, a package or a titles
To reproduce

1- Enable the ERMModule system preference
    1- Go to Administration > System Preferences
    2- Search for ERMModule
    3- Change the value to "Enable"
    4- Click on "Save all e-resource management preferences"
    5- Return to the main screen
1- Create an agreement
    1- Go to e-resource management
    2- Click on "Agreements"
    3- Click on "New agreement"
    4- Fill out the form (mandatory fields)
        - Agreement name: Natural Medicines
        - Status: Active
    5- Click on "Submit"
2- Edit the agreement
    1- Click on "Agreements"
    2- Click on "Edit" to the right of the Natural Medicines agreement
    3- Click on "Submit"
        --> Something went wrong: SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data
We got the same error when editing a license, a package or a title

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:50 -06:00
Tomás Cohen Arazi 6b478e0da9
Bug 40163: (follow-up) Fix wrong GNU links and update test
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-24 09:25:04 -06:00
Tomas Cohen Arazi 1873d97c07
Bug 40163: Fix several http addresses in the code docs
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-23 16:21:29 -06:00
Tomas Cohen Arazi 67a7901663
Bug 39190: Rename API from sftp_servers to file_transports
This patch renames the entire API structure from SFTP-specific to generic
file transport terminology to reflect the polymorphic nature of the system.

API Changes:
- Endpoints: /config/sftp_servers -> /config/file_transports
- Parameters: sftp_server_id -> file_transport_id
- Definitions: sftp_server -> file_transport
- Controller: Config::SFTP::Servers -> Config::File::Transports

File Changes:
- api/v1/swagger/definitions/sftp_server.yaml -> file_transport.yaml
- api/v1/swagger/paths/config_sftp_servers.yaml -> config_file_transports.yaml
- Koha/REST/V1/Config/SFTP/Servers.pm -> Koha/REST/V1/Config/File/Transports.pm
- t/db_dependent/api/v1/sftp_servers.t -> file_transports.t

Updated References:
- swagger.yaml: paths, definitions, parameters, tags
- Template JavaScript: API URLs and variable names
- Controller: package name, variable names, error messages
- Tests: endpoints, parameters, descriptions
- API mapping: to_api_mapping field name correction

To test:
1. Apply this patch
2. Run: yarn api:bundle (to regenerate swagger bundle)
3. Run: prove t/db_dependent/api/v1/file_transports.t
4. All API tests should pass
5. Verify admin interface uses new API endpoints
6. Test CRUD operations work correctly

The API now consistently uses 'file_transports' terminology matching
the polymorphic file transport system that supports FTP, SFTP, and
future transport types.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-19 13:23:25 -06:00
Martin Renvoize df10cb02d4
Bug 39190: Update API's to reference new classes
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-19 13:23:20 -06:00
Martin Renvoize c4d4c94567
Bug 39190: Remove replaced test_connection
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-19 13:23:19 -06:00
Martin Renvoize f92a1b8e14
Bug 39190: Remove test routine from API
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-19 13:23:19 -06:00
Martin Renvoize 4b4bffdf2d
Bug 39190: Update API to use new Transport classes
As the title says, use the new polymorphic classes in the API
controllers

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-19 13:23:15 -06:00
Jake Deery f33638f14b
Bug 35761: Introduce central FTP/SFTP management
This patch adds a central FTP/SFTP management UI, with an associated
database object and class, plus the beginnings of an API. We can use
this code as a building block for adding FTP/SFTP connections to
other parts of the system, as well as to improve the usability of the
EDI transports. It is also now possible to test these connections
from within the Koha UI.

To test:-
You will need access to an FTP or SFTP server
Contact me if you need a disposable FTP/SFTP server

a)  Go to Koha Administration
b)  Notice no FTP/SFTP referenced on this page
c)  APPLY PATCH, reset_all
d)  Create new user, let's say sftpuser
e)  Set permissions for new user to include:
    1)  catalogue
    2)  parameters -> manage_sftp_servers
f)  Log in with this new user, go back to Koha Administration
    1)  Notice the FTP/SFTP servers option
g)  Undo step e2) for the sftpuser via the koha admin user
    1)  Refresh the Koha Administration page as the sftpuser
    2)  Notice how FTP/SFTP servers has disappeared
h)  Back to koha admin, go to Koha Administration -> FTP/SFTP Servers -> New
i)  Complete form depending on the FTP or SFTP server you have access to, Submit
    1)  Notice you are prompted to confirm before saving
j)  Select Edit, observe your details are the same, and Submit again
k)  Repeat step J one additional time
l)  Select Test, observe all tests passing
m)  Select Delete, confirm deletion, and observe server disappear
n)  Optionally, run prove on new tests
    1)  t/Koha/Auth/Permissions.t
    2)  t/db_dependent/Koha/SFTP/Server.t
    3)  t/db_dependent/api/v1/sftp_servers.t
o)  SIGN-OFF

Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-19 13:23:11 -06:00
Matt Blenkinsop e4a19c945e
Bug 36831: Move logic from the background job to the Title object class
This patch moves logic out of the background job file and into the Koha::ERM::EHoldings::Title class where it should belong. Methods are also renamed to differentiate between object methods and helper methods

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-18 14:31:00 -06:00
Pedro Amorim ff82cd37f5
Bug 39345: Use data provider report release to establish service URL
Signed-off-by: Eric Phetteplace <phette23@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-05 15:10:29 -06:00
Tomas Cohen Arazi cd4e1da3ec
Bug 40275: Use Koha::Patrons->find_by_identifier in the codebase
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-03 14:00:46 -06:00
Martin Renvoize 5350a9276e
Bug 9762: (Alternative) Log circulation overrides
An alternative approach to the original submission for bug 9762. Instead
of recording a distinct action log line for a set of override messages
in addition to the standard issue record, this patch updates the
existing issue log to include any confirmation or impossible responses
from the preceeding CanBookBeIssued call.

We continue to record these as a JSON structure as the prior patch did,
but instead of human messages we use the predefined codes as returned
from the existing CanBookBeIssued response.

To test:

After each step, a single action log message should be displayed under
`Tools > Log viewer`. The message itself will now consist of a JSON
string with an array of 'confirmations' and 'forced' strings
representing the overriden feedback from CanBookBeIssued.

Circulation -- Checking out

1) Check out an item that is age-restricted (AgeRestrictionOverride syspref)
2) Check out an item that has a “not for loan” status (AllowNotForLoanOverride
   syspref)
3) Check out an item that has a “lost” status (IssueLostItem syspref)
4) Check out an item to a patron who has reached the checkout limit
   (AllowTooManyOverride syspref)
5) Check out an item to a patron who is not allowed to borrow this item type
6) Check out an item to a patron who has unpaid fines (AllFinesNeedOverride
   and/or AllowFineOverride + noissuescharge sysprefs)
7) Check out an item on hold for someone else
8) Check out an item on hold ready for pickup by someone else
9) Check out an item already checked out to someone else
   (AutoReturnCheckedOutItems syspref)
10) Check out to a patron who has restrictions

Circulation -- Checking in

11) Ignore a hold upon check in
12) Ignore a hold and transfer upon check in

Circulation – Renewing

13) Renew an item on hold for someone else
    (AllowRenewalOnHoldOverride syspref)
14) Renew an item that has reached the maximum number of renewals
    (AllowRenewalLimitOverride syspref)

Holds

15) Place a hold for a patron who is not allowed to place this item
    type on hold (AllowHoldPolicyOverride syspref)
16) Place a hold for a patron who has reached the maximum number of
    holds
17) Place an item-level hold when rules dictate that this is not
    allowed

Sponsored-by: OpenFifth <https://openfifth.co.uk/>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-03 11:42:10 -06:00
CJ Lynce ba43483f4d
Bug 36536: Make REST APIs validateUserAndPassword update borrowers.lastseen
This patch added the option to update borrowers.lastseen when a patron username
    and password is verified via the REST API. This can be enabled or disabled
    selectively using the TrackLastPatronActivityTriggers system preference
    using the [ ] Patron authentication via API option..

To test:
1.  Create a new user, ensuring to set the Username and password fields.
	    *Import to do this first*
2.  Edit the TrackLastPatronActivityTriggers syspref and check all options.
3.  Ensure the RESTBasicAuth syspref is set to Enable.
4.  Check the lastseen date of your new user using a SQL report
        SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid = 'USERNAME'
        (Replace USERNAME with your chosen username for the new patron)
        NOTE: **Ensure the cache expiry of the SQL report is set to 0**
5.  The lastseen for your new user should be null
6.  'restart_all' Koha services to clear plack cache.
7.  Run the attached api_verify_lastseen.pl test script
        **Change P_USERNAME and P_PASSWORD to the username and password of your new user.
        (script contains expected output for successful verification)
8.  Re-check the lastseen date of your new user again via SQL (step 4)
        The lastseen should still be null.

9.  Apply Patch
10. 'restart_all' Koha services

11. Edit the TrackLastPatronActivityTriggers syspref and check the '[ ] Patron authentication via API' option
12. Rerun the api_verify_lastseen.pl
13. Re-check the lastseen date of your new user again via SQL (step 4)
        The lastseen should now be updated to the time of the last script run.

For good measure:
14. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** the '[ ] Patron authentication via API' option
15. 'restart_all' Koha services to clear plack cache.
16. Rerun the api_verify_lastseen.pl
17. Re-check the lastseen date of your new user again via SQL (step 4)
        The lastseen should have remained the same as previous.

Sponsored-by: Westlake Porter Public Library <https://westlakelibrary.org>
Signed-off-by: Bernard Scaife <bernard.scaife@openfifth.co.uk>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-08-29 11:08:44 -06:00
Pedro Amorim ad66f7d7d3
Bug 40395: Preparation: suspension_bulk REST API endpoint
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-08-20 13:43:09 -06:00
Pedro Amorim 316745f3e2
Bug 39900: REST API specs and class changes
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-08-14 16:05:54 -06:00
Pedro Amorim 6649b406c1
Bug 39091: Add cash registers list REST API endpoint
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-07-23 16:36:40 -06:00
Matt Blenkinsop f30b6f668c
Bug 40417: Remove 'validation' method
We shouldn't use the ->validation method anymore as it isn't stable. We need to pass the params into the method accounting for any param changes made

Test plan:
1) Apply the regression test patch and run the test
2) Test should fail
3) Apply this patch
4) Run test again
5) Test should pass

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-07-23 16:36:39 -06:00
Tomas Cohen Arazi 17b851bff0
Bug 40424: Make query-in-body rely on `$c->req->json`
This patch removes the reliance on `$c->validation->output` for the
query-in-body feature. This will allow bug 40417 to move forward.

It also fixes some wrong design decisions we made 5-6 years ago. This
was discussed with the Mojolicious::Plugin::OpenAPI maintainer and the
agreement was `$c->validation->output` was not stable nor intended to be
accessed like we do.

To test:
1. Run:
   $ ktd --shell
  k$ prove t/Koha/REST/Plugin/Query.t \
           t/db_dependent/api/v1/*.t \
           t/db_dependent/Koha/REST/Plugin/*
=> SUCCESS: Tests pass!
2. Apply this patchset
3. Repeat 1
=> SUCCESS: Tests pass!
4. Sign off :-D

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-07-23 16:36:38 -06:00
Tomas Cohen Arazi 710bf4bb1b
Bug 40424: Simplify existing code - preparation
I wanted to isolate the changes for the query-in-body handling and it
made sense to refactor this dupicated code at the same time. So I add
this patch for tidying the area in preparation for the other part.

Duplicated code gets simplified.

To test:
1. Apply the unit tests patch
2. Run:
   $ ktd --shell
  k$ prove t/Koha/REST/Plugin/Query.t \
           t/db_dependent/api/v1/*.t \
           t/db_dependent/Koha/REST/Plugin/
=> SUCCESS: Tests pass!
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-07-23 16:36:38 -06:00
Tomas Cohen Arazi 5e94e44ee2
Bug 40423: Add helper to stash x-koha-request-id header value
This patch aligns handling of the header with how other headers are
managed.

* A helper is added which reads the header and stashes the value
* The helper is called in the same place similar helpers are called
  (authenticate_api_request)
* The `objects.search_rs` helper is adjusted to use the stashed value
  instead of picking it from the reserved params.

To test:
1. Apply this patches
2. Run:
   $ ktd --shell
  k$ prove t/Koha/REST/Plugin/Query.t \
           t/db_dependent/api/v1/*.t \
           t/db_dependent/Koha/REST/Plugin/*
=> SUCCESS: Tests pass! No behavior change!
3. Sign off :-D

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-07-23 16:36:37 -06:00
Tomas Cohen Arazi 6f1bd24e87
Bug 40419: Fix wrong license
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-07-18 11:09:54 -06:00
Tomas Cohen Arazi afd00523a3
Bug 40254: Fix error in overrides check allowing too much
This patch fixes a subtle (yet naive) error making the controller not
care about blocking conditions if they were more than one and the first
one was overridden.

To test:
1. Apply the regression tests
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/holds.t
=> FAIL: Tests fail! Some tests expect a 409 (denied for a conflict) but
return a 201!
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-06-30 08:30:45 -06:00
Tomas Cohen Arazi f245ad1605
Bug 39657: Add more checks and overrides to hold creation endpoint
This patch adds new behaviors to the `POST /holds` endpoint.

It uses the framework we created in the past for overriding policy
rules, and add new options:

* expired
* debt_limit
* bad_address
* card_lost
* restricted
* hold_limit

Some status codes are changed from 403 to 409. This should be revisited
accross the codebase, as I think we made a wrong choice. Happy to review
in this bug.

The feature makes use of the newly introduced
`$patron->can_place_holds()` method, which accepts to be passed through
the overrides.

To test:
1. Apply this patches
2. Run:
   $ ktd --shell
  k$ yarn api:bundle
  k$ koha-plack --restart kohadev
  k$ prove t/db_dependent/api/v1/holds.t
=> SUCCESS: Tests pass!
3. Test the endpoint with the various scenarios using your favourite
   REST tool (Postman!)
4. Sign off :-D

Signed-off-by: Kristi Krueger <kkrueger@cuyahogalibrary.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-06-26 12:47:52 -06:00
Jonathan Druart 9d72067523
Bug 38010: Fix vendor deletion tests
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:31 +02:00
Matt Blenkinsop 48592d9d3d
Bug 38010: Add protection logic to the DELETE endpoint
Amended-by: Jonathan Druart
typo: subsicriptions => subscriptions

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:30 +02:00
Matt Blenkinsop fb4f2e42b1
Bug 38010: Migrate to_api logic to GET endpoint
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:28 +02:00
Matt Blenkinsop 9105ba1e63
Bug 38010: (QA follow-up) Move syspref values to config endpoint
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:26 +02:00
Jonathan Druart 1e780ea61d
Bug 38010: Add tests for embed contacts,interfaces,aliases
(cherry picked from commit cae75569e6e8f2bfe5a2e6d3acc111485f81cc1e)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:25 +02:00
Jonathan Druart 9c1f586b3d
Bug 38010: Fix wrong use of scalar in the REST API controller
It was wrong, we need to use scalar on the array, not the arrayref
(otherwise it will always be true)
No change in behaviour expected here, just some code cleaning

(cherry picked from commit 7abbcb7ba73da13d988202aaf06ba239e21692da)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:25 +02:00
Matt Blenkinsop 7d0b44d9dc
Bug 38010: (QA follow-up) Add a config endpoint for permissions
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:16 +02:00
Matt Blenkinsop 64a43ee022
Bug 38010: (QA follow-up) Handle form parameters in the browser
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:14 +02:00
Matt Blenkinsop 6fa18591cb
Bug 38010: (QA follow-up) UI fixes
This patch addresses
- Translation issues in VendorList
- Removing the pagers from the contracts table
- Removing redundant code from the vendors template file

Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:19:13 +02:00
Matt Blenkinsop 29ca78bb48
Bug 38010: Prevent vendor contacts from duplicating
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:18:55 +02:00
Matt Blenkinsop d4c3342262
Bug 38010: Reset basket view
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:18:49 +02:00
Matt Blenkinsop 86bb920254
Bug 38010: Respect AcqViewBaskets syspref
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:18:42 +02:00
Matt Blenkinsop 8e99ee7dd6
Bug 38010: Adjust vendor update logic
This patch handles the embedded data that might also need updating when editing a vendor

Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:18:36 +02:00
Matt Blenkinsop 1018810681
Bug 38010: Add the form to add a new vendor
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 17:18:30 +02:00