Permissions on holds GET endpoint and request.pl are different. Staff member can see holds with place_holds permission and but via REST API it is blocked. Also a staff member can see and modify holds on patron's page without edit_borrowers permission. The GET endpoint should use place_holds permission to be more consistent.
Created attachment 140611 [details] [review] Bug 31555: change holds GET permission to place_holds This patch changes holds' GET REST API endpoint permission to place_holds to match with request.pl Test plan: 1) prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy
Created attachment 140630 [details] [review] Bug 31555: change holds GET permission to place_holds This patch changes holds' GET REST API endpoint permission to place_holds to match with request.pl Test plan: 1) prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy Signed-off-by: David Nind <david@davidnind.com>
Created attachment 141503 [details] [review] Bug 31555: change holds GET permission to place_holds This patch changes holds' GET REST API endpoint permission to place_holds to match with request.pl Test plan: 1) prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Our permissions need a revamp (i.e. we should have individual permissions for each hold action).
Pushed to master for 22.11. Nice work everyone, thanks!