We're now using the API for loading orders in the order receive page. As such, we need to allow the GET orders endpoint to function with that permission too. We have customers where they restrict staff to either 'ordering' or 'receiving' using permissions.. as we require 'order_manage' or 'order_manage_all' their users with just 'order_recieve' get a 403 when the orders table attempts to load on receive pages.
Created attachment 152290 [details] [review] Bug 33993: Add order_receive to GET orders endpoints This adds order_receive to the list of permissions that allow the endpoint to return orders.
I am testing using this plan: 1. Have a user with just the 'order_recieve' permission. Log in, or use PostMan, to hit '/api/v1/acquisitions/orders/'. 2. You don't have permission to view the page 3. Give the user the 'order_recieve' permission. Hit '/api/v1/acquisitions/orders/'. Now you should see the response.
Created attachment 152324 [details] [review] Bug 33993: Add order_receive to GET orders endpoints This adds order_receive to the list of permissions that allow the endpoint to return orders. Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Created attachment 152625 [details] [review] Bug 33993: Add order_receive to GET orders endpoints This adds order_receive to the list of permissions that allow the endpoint to return orders. Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Sharon Dugdale <Sharon.Dugdale@cumberland.gov.uk>
Tiny bug.. now also signed off by the customer who reported the problem. I think we can safety PQA this ;)
Pushed to master for 23.11. Nice work everyone, thanks!
Thanks for all the hard work! Pushed to 23.05.x for the next release
Nice work everyone! Pushed to 22.11.x for next release