Hide OPAC-invisible holdings from SRU/Z39.50

The basic_holdings Supercat method filtered out deleted call numbers and
copies, but didn't filter out copies based on the OPAC visibility status
of copy location / status / the copy itself. This has undesired results
when third-party services request copies via SRU or Z39.50 and expose
copies that should not be visible to the public.

We wrap all of the visibility and deletedness checks for a given copy up
into a subroutine so that we can avoid repeating ourselves in the
basic_holdings logic. Also, if we missed a test, we can add it in one
handy place :)

(Thanks to Galen Charlton for finding two missing tests: circ lib
visibility and owning lib visibility!)

Signed-off-by: Dan Scott <dscott@laurentian.ca>
Signed-off-by: Art Rhyno <art632000@yahoo.ca>

diff --git a/Open-ILS/src/perlmods/lib/OpenILS/Application/SuperCat.pm b/Open-ILS/src/perlmods/lib/OpenILS/Application/SuperCat.pm
index d98bb3d..71b4b5f 100644 (file)
--- a/Open-ILS/src/perlmods/lib/OpenILS/Application/SuperCat.pm
+++ b/Open-ILS/src/perlmods/lib/OpenILS/Application/SuperCat.pm
@@ -2045,7 +2045,7 @@ sub basic_record_holdings {
                my $found = 0;
                for my $c (@{$cn->copies}) {
                        next unless grep {$c->circ_lib->id == $_} @ou_ids;
-                       next unless ( $c->deleted eq 'f' || $c->deleted == 0 );
+                       next unless _cp_is_visible($cn, $c);
                        $found = 1;
                        last;
                }
@@ -2056,7 +2056,7 @@ sub basic_record_holdings {
                for my $cp (@{$cn->copies}) {
 
                        next unless grep { $cp->circ_lib->id == $_ } @ou_ids;
-                       next unless ( $cp->deleted eq 'f' || $cp->deleted == 0 );
+                       next unless _cp_is_visible($cn, $cp);
 
                        push @{$holdings{$cn->label}{'copies'}}, {
                 barcode => $cp->barcode,
@@ -2071,6 +2071,24 @@ sub basic_record_holdings {
        return \%holdings;
 }
 
+sub _cp_is_visible {
+    my $cn = shift;
+    my $cp = shift;
+
+    my $visible = 0;
+    if ( ($cp->deleted eq 'f' || $cp->deleted == 0) &&
+         $cp->location->opac_visible eq 't' && 
+         $cp->status->opac_visible eq 't' &&
+         $cp->opac_visible eq 't' &&
+         $cp->circ_lib->opac_visible eq 't' &&
+         $cn->owning_lib->opac_visible eq 't'
+    ) {
+        $visible = 1;
+    }
+
+    return $visible;
+}
+
 #__PACKAGE__->register_method(
 #      method    => 'new_record_holdings',
 #      api_name  => 'open-ils.supercat.record.holdings_xml.retrieve',