From fa4f00dbbbb198d316503c59a46c33dc5aa8b7c6 Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Fri, 13 Sep 2019 11:26:03 -0300
Subject: [PATCH] Bug 23607: Make /patrons/:patron_id/account staff only

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 8171c9d05dc3adf0014a727e304f666606f7f751)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 4c681e4e913a62f9efc72e145a327d2ee5b77711)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 api/v1/swagger/paths/patrons_account.json | 2 --
 t/db_dependent/api/v1/patrons_accounts.t  | 9 +++++----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/api/v1/swagger/paths/patrons_account.json b/api/v1/swagger/paths/patrons_account.json
index 8ad88f0896..428999fe00 100644
--- a/api/v1/swagger/paths/patrons_account.json
+++ b/api/v1/swagger/paths/patrons_account.json
@@ -53,8 +53,6 @@
         }
       },
       "x-koha-authorization": {
-        "allow-owner": true,
-        "allow-guarantor": true,
         "permissions": {
           "borrowers": "edit_borrowers",
           "updatecharges": "remaining_permissions"
diff --git a/t/db_dependent/api/v1/patrons_accounts.t b/t/db_dependent/api/v1/patrons_accounts.t
index bf8b9de62e..dcdf9c5cb3 100644
--- a/t/db_dependent/api/v1/patrons_accounts.t
+++ b/t/db_dependent/api/v1/patrons_accounts.t
@@ -45,9 +45,10 @@ subtest 'get_balance() tests' => sub {
 
     $schema->storage->txn_begin;
 
-    my ( $patron, $session_id ) = create_user_and_session({ authorized => 0 });
-    my $patron_id  = $patron->id;
-    my $account = $patron->account;
+    my ( $patron, $session_id ) = create_user_and_session({ authorized => 1 });
+    my $library   = $builder->build_object({ class => 'Koha::Libraries' });
+    my $patron_id = $patron->id;
+    my $account   = $patron->account;
 
     my $tx = $t->ua->build_tx(GET => "/api/v1/patrons/$patron_id/account");
     $tx->req->cookies({ name => 'CGISESSID', value => $session_id });
@@ -235,7 +236,7 @@ subtest 'add_credit() tests' => sub {
 sub create_user_and_session {
 
     my $args  = shift;
-    my $flags = ( $args->{authorized} ) ? 2**10 : 0;
+    my $flags = ( $args->{authorized} ) ? 1 : 0;
 
     my $patron = $builder->build_object(
         {
-- 
2.39.5