Bug 35773 - Cannot create bookings without edit_borrowers, label_creator, routing or order_manage permissions
Summary: Cannot create bookings without edit_borrowers, label_creator, routing or orde...
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Martin Renvoize
QA Contact: Testopia
URL:
Keywords:
Depends on: 29002
Blocks: 29509
  Show dependency treegraph
 
Reported: 2024-01-11 15:20 UTC by Martin Renvoize
Modified: 2024-03-19 20:38 UTC (History)
10 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.04


Attachments
Bug 35773: Add manage_bookings subpermission to patron searching (1023 bytes, patch)
2024-01-11 15:24 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 35773: Add manage_bookings subpermission to patron searching (1.06 KB, patch)
2024-02-16 21:49 UTC, David Nind
Details | Diff | Splinter Review
Bug 35773: Add manage_bookings subpermission to patron searching (1.11 KB, patch)
2024-03-01 20:36 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize 2024-01-11 15:20:51 UTC
When attempting to place a booking on an item in the catalogue a user needs several permissions:
1 - Patron search permissions (see bug 29509) [Any of "borrowers:edit_borrowers", "tools:label_creator", "serials:routing", "acquisition:order_manage"]
2 - circulate: manage_bookings
3 - circulate_ circulate_remaning_permissions

If you don't have one of the first, the loading of patrons seems dies on looking up patrons via the api
Comment 1 Martin Renvoize 2024-01-11 15:24:19 UTC
Created attachment 160876 [details] [review]
Bug 35773: Add manage_bookings subpermission to patron searching

This quickly fixes the issue to allowing those who have the
manage_bookings subpermission to also search for users.

It's deliberately bare as I'm keen to subsequently remove it again in
bug 29509 where we will deal with this properly.
Comment 2 Magnus Enger 2024-02-09 14:25:26 UTC
(In reply to Martin Renvoize from comment #1)
> It's deliberately bare as I'm keen to subsequently remove it again in
> bug 29509 where we will deal with this properly.

Could this bug (35773) be closed now that "Bug 29509 - GET /patrons* routes permissions excessive is "Needs Signoff"? Or is it still needed?
Comment 3 Martin Renvoize 2024-02-16 16:30:12 UTC
They're really meant to be applied in order Magnus. I did that so that we get this important fix in 23.11.x even if we don't backport 29509
Comment 4 David Nind 2024-02-16 21:49:28 UTC
Created attachment 162249 [details] [review]
Bug 35773: Add manage_bookings subpermission to patron searching

This quickly fixes the issue to allowing those who have the
manage_bookings subpermission to also search for users.

It's deliberately bare as I'm keen to subsequently remove it again in
bug 29509 where we will deal with this properly.

Signed-off-by: David Nind <david@davidnind.com>
Comment 5 David Nind 2024-02-16 21:55:05 UTC
Testing notes (using KTD):

1. As the koha user, set up an item for booking and place a booking - everything should work as expected:
   1.1 Enable an item to be booked:
       . Go to a record with item(s).
       . Go to the items tab.
       . Update an item so that it is bookable (Priority section, update Bookable to 'Yes'
   1.2 From the buttons above the title, select 'Place booking':
       . Choose a patron
       . Select a period (click a start and end date)
       . Submit

2. Set up another staff patron (such as Henry) so that:
   2.1 You can log in as them.
   2.2 They have these permissions:
       . Staff access, allows viewing of catalogue in staff interface (catalogue)
       . Check out and check in items (circulate) (including Manage item bookings (manage_bookings))

3. Log in as them and try to make a booking - note that when searching for the patron name (such as lisa or mary), that you get no search results and can't select a patron.

4. Apply the patch, flush_memcached, and restart everything (restart_all)

5. Try again to make a booking - you should now be able to successfully search for a patron and submit the booking.
Comment 6 Victor Grousset/tuxayo 2024-03-01 20:36:36 UTC
Created attachment 162695 [details] [review]
Bug 35773: Add manage_bookings subpermission to patron searching

This quickly fixes the issue to allowing those who have the
manage_bookings subpermission to also search for users.

It's deliberately bare as I'm keen to subsequently remove it again in
bug 29509 where we will deal with this properly.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 7 Victor Grousset/tuxayo 2024-03-01 21:00:57 UTC
Works, makes sense, QA script happy, code looks good, passing QA :)

Should circulate_remaning_permissions be needed for bookings? It's the one necessary for the calendar to load in the booking form.
Even if there is something to do about it, it's not really for this ticket so still passing QA.
Comment 8 Katrin Fischer 2024-03-07 16:37:18 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 9 Fridolin Somers 2024-03-11 10:22:23 UTC
Pushed to 23.11.x for 23.11.04
Comment 10 Lucas Gass 2024-03-19 20:38:19 UTC
Missing 23.05.x dependencies, no backport.