Bug 33993 - The GET orders endpoint needs to allow users with order_receive permission
Summary: The GET orders endpoint needs to allow users with order_receive permission
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Acquisitions (show other bugs)
Version: Main
Hardware: All All
: P5 - low major (vote)
Assignee: Martin Renvoize
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-06-13 08:44 UTC by Martin Renvoize
Modified: 2023-12-28 20:47 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.02,22.11.08


Attachments
Bug 33993: Add order_receive to GET orders endpoints (878 bytes, patch)
2023-06-13 08:46 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 33993: Add order_receive to GET orders endpoints (934 bytes, patch)
2023-06-13 19:53 UTC, Lucas Gass
Details | Diff | Splinter Review
Bug 33993: Add order_receive to GET orders endpoints (999 bytes, patch)
2023-06-23 08:44 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize 2023-06-13 08:44:09 UTC
We're now using the API for loading orders in the order receive page. As such, we need to allow the GET orders endpoint to function with that permission too.

We have customers where they restrict staff to either 'ordering' or 'receiving' using permissions.. as we require 'order_manage' or 'order_manage_all' their users with just 'order_recieve' get a 403 when the orders table attempts to load on receive pages.
Comment 1 Martin Renvoize 2023-06-13 08:46:32 UTC
Created attachment 152290 [details] [review]
Bug 33993: Add order_receive to GET orders endpoints

This adds order_receive to the list of permissions that allow the
endpoint to return orders.
Comment 2 Lucas Gass 2023-06-13 19:52:55 UTC
I am testing using this plan:

1. Have a user with just the 'order_recieve' permission. Log in, or use PostMan, to hit '/api/v1/acquisitions/orders/'.
2. You don't have permission to view the page
3. Give the user the 'order_recieve' permission. Hit '/api/v1/acquisitions/orders/'. Now you should see the response.
Comment 3 Lucas Gass 2023-06-13 19:53:31 UTC
Created attachment 152324 [details] [review]
Bug 33993: Add order_receive to GET orders endpoints

This adds order_receive to the list of permissions that allow the
endpoint to return orders.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 4 Martin Renvoize 2023-06-23 08:44:54 UTC
Created attachment 152625 [details] [review]
Bug 33993: Add order_receive to GET orders endpoints

This adds order_receive to the list of permissions that allow the
endpoint to return orders.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Sharon Dugdale <Sharon.Dugdale@cumberland.gov.uk>
Comment 5 Martin Renvoize 2023-06-23 08:45:30 UTC
Tiny bug.. now also signed off by the customer who reported the problem.

I think we can safety PQA this ;)
Comment 6 Tomás Cohen Arazi 2023-06-23 12:46:18 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 7 Martin Renvoize 2023-07-17 12:46:02 UTC
Thanks for all the hard work!

Pushed to 23.05.x for the next release
Comment 8 Pedro Amorim 2023-07-18 10:50:31 UTC
Nice work everyone!

Pushed to 22.11.x for next release