Created attachment 92802 [details] [review] Bug 23607: Make /patrons/:patron_id/account staff only Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
What is the test plan for this?
Created attachment 92918 [details] [review] Bug 23607: Make /patrons/:patron_id/account staff only Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Tested with this plan: 1) remove two lines from api/v1/swagger/paths/patrons_account.json as in patch 2) prove t/db_dependent/api/v1/patrons_accounts.t --> it should fails with http status 403 3) git checkout -- api/v1/swagger/paths/patrons_account.json 4) apply patch 5) prove t/db_dependent/api/v1/patrons_accounts.t --> now it return green
Created attachment 93184 [details] [review] Bug 23607: Make /patrons/:patron_id/account staff only Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Side note: staff only in the title is a bit confusing, since you can still see it via opac if your user has these two permissions.
Nice work! Pushed to master for 19.11.00
Pushed to 19.05.x for 19.05.05
backported to 18.11.x for 18.11.11