From 1fb03f1548ec6edfa1d22c9821202249e2c00b49 Mon Sep 17 00:00:00 2001 From: Pedro Amorim Date: Wed, 15 Feb 2023 17:40:17 +0000 Subject: [PATCH] Bug 32968: (WIP) Create granular permissions for ERM This is just a work in progress but open for discussion if anyone has any input, ideally would like to have a wildcard for erm subpermissions on x-koha-authorization paths but as it stands the way I found that works is listing all sub-permissions (idea is to give read access to agreements even if user only has 'manage_licenses' permission --- Koha/REST/V1/ERM.pm | 2 +- api/v1/swagger/paths/erm_agreements.yaml | 20 ++++++++++---- api/v1/swagger/paths/erm_licenses.yaml | 20 ++++++++++---- erm/erm.pl | 2 +- .../data/mysql/atomicupdate/bug_32968.pl | 21 +++++++++++++++ .../data/mysql/mandatory/userpermissions.sql | 7 ++++- .../prog/en/includes/permissions.inc | 26 +++++++++++++++++++ .../intranet-tmpl/prog/en/modules/erm/erm.tt | 8 ++++++ .../prog/js/vue/components/ERM/ERMMain.vue | 6 +++++ 9 files changed, 99 insertions(+), 13 deletions(-) create mode 100644 installer/data/mysql/atomicupdate/bug_32968.pl diff --git a/Koha/REST/V1/ERM.pm b/Koha/REST/V1/ERM.pm index 3f98a8e12d..3d398f6618 100644 --- a/Koha/REST/V1/ERM.pm +++ b/Koha/REST/V1/ERM.pm @@ -42,7 +42,7 @@ sub list_users { return try { - my $patrons_rs = Koha::Patrons->search->filter_by_have_permission('erm'); + my $patrons_rs = Koha::Patrons->search->filter_by_have_permission('erm'); #TODO: Double-check that related users are working my $patrons = $c->objects->search( $patrons_rs ); return $c->render( diff --git a/api/v1/swagger/paths/erm_agreements.yaml b/api/v1/swagger/paths/erm_agreements.yaml index 36eab29a5b..4b3467fbcc 100644 --- a/api/v1/swagger/paths/erm_agreements.yaml +++ b/api/v1/swagger/paths/erm_agreements.yaml @@ -93,7 +93,12 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - erm: 1 + erm: + - manage_agreements + - manage_licenses + - manage_packages + - manage_titles + - manage_providers_resources post: x-mojo-to: ERM::Agreements#add operationId: addErmAgreements @@ -153,7 +158,7 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - erm: 1 + erm: manage_agreements "/erm/agreements/{agreement_id}": get: x-mojo-to: ERM::Agreements#get @@ -195,7 +200,12 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - erm: 1 + erm: + - manage_agreements + - manage_licenses + - manage_packages + - manage_titles + - manage_providers_resources x-koha-embed: - periods - user_roles @@ -264,7 +274,7 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - erm: 1 + erm: manage_agreements x-koha-embed: - periods - user_roles @@ -316,4 +326,4 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - erm: 1 + erm: manage_agreements diff --git a/api/v1/swagger/paths/erm_licenses.yaml b/api/v1/swagger/paths/erm_licenses.yaml index bb32fb93f3..e294303b20 100644 --- a/api/v1/swagger/paths/erm_licenses.yaml +++ b/api/v1/swagger/paths/erm_licenses.yaml @@ -78,7 +78,12 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - erm: 1 + erm: + - manage_agreements + - manage_licenses + - manage_packages + - manage_titles + - manage_providers_resources post: x-mojo-to: ERM::Licenses#add operationId: addERMLicenses @@ -138,7 +143,7 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - erm: 1 + erm: manage_licenses "/erm/licenses/{license_id}": get: x-mojo-to: ERM::Licenses#get @@ -180,7 +185,12 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - erm: 1 + erm: + - manage_agreements + - manage_licenses + - manage_packages + - manage_titles + - manage_providers_resources x-koha-embed: - user_roles - user_roles.patron @@ -242,7 +252,7 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - erm: 1 + erm: manage_licenses x-koha-embed: - user_roles - documents @@ -291,4 +301,4 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - erm: 1 + erm: manage_licenses diff --git a/erm/erm.pl b/erm/erm.pl index 9118a7336e..97f970476d 100755 --- a/erm/erm.pl +++ b/erm/erm.pl @@ -32,7 +32,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( template_name => "erm/erm.tt", query => $input, type => "intranet", - flagsrequired => { 'erm' => '1' }, + flagsrequired => { 'erm' => '*' }, } ); diff --git a/installer/data/mysql/atomicupdate/bug_32968.pl b/installer/data/mysql/atomicupdate/bug_32968.pl new file mode 100644 index 0000000000..ec151e8078 --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_32968.pl @@ -0,0 +1,21 @@ +use Modern::Perl; +# TODO: +# finish this atomicupdate for 32968 +# update kohastructure.sql + +return { + bug_number => "32968", + description => "Create granular permissions for ERM", + up => sub { + my ($args) = @_; + my ($dbh, $out) = @$args{qw(dbh out)}; + + say $out "Added new permission 'XXX'"; + + $dbh->do(q{ INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (28, 'manage_agreements', 'Create, edit and delete agreements') }); + $dbh->do(q{ INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (28, 'manage_licenses', 'Create, edit and delete licenses') }); + $dbh->do(q{ INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (28, 'manage_packages', 'Create, edit and delete local packages') }); + $dbh->do(q{ INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (28, 'manage_titles', 'Create, edit and delete local titles') }); + $dbh->do(q{ INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (28, 'manage_providers_resources', 'Create, edit and delete providers packages and titles') }); + }, +}; \ No newline at end of file diff --git a/installer/data/mysql/mandatory/userpermissions.sql b/installer/data/mysql/mandatory/userpermissions.sql index 7b6955de44..4b5843f306 100644 --- a/installer/data/mysql/mandatory/userpermissions.sql +++ b/installer/data/mysql/mandatory/userpermissions.sql @@ -148,5 +148,10 @@ INSERT INTO permissions (module_bit, code, description) VALUES (25, 'cashup', 'Perform cash register cashup action'), (25, 'takepayment', 'Access the point of sale page and take payments'), (26, 'manage_problem_reports', 'Manage OPAC problem reports'), - (27, 'manage_recalls', 'Manage recalls for patrons') + (27, 'manage_recalls', 'Manage recalls for patrons'), + (28, 'manage_agreements', 'Create, edit and delete agreements'), + (28, 'manage_licenses', 'Create, edit and delete licenses'), + (28, 'manage_packages', 'Create, edit and delete local packages'), + (28, 'manage_titles', 'Create, edit and delete local titles'), + (28, 'manage_providers_resources', 'Create, edit and delete providers packages and titles') ; diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc index a8bfd89e02..b201969e3c 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc @@ -846,5 +846,31 @@ Manage authentication providers ([% name | html %]) + [%# erm %] + [%- CASE 'manage_agreements' -%] + + Create, edit and delete agreements + + ([% name | html %]) + [%- CASE 'manage_licenses' -%] + + Create, edit and delete licenses + + ([% name | html %]) + [%- CASE 'manage_packages' -%] + + Create, edit and delete local packages + + ([% name | html %]) + [%- CASE 'manage_titles' -%] + + Create, edit and delete local titles + + ([% name | html %]) + [%- CASE 'manage_providers_resources' -%] + + Create, edit and delete providers' packages and titles + + ([% name | html %]) [%- END -%] [%- END -%] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt index 8171ea6a8a..6204bb7a4a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt @@ -60,6 +60,14 @@ const logged_in_user_lists = [% To.json(logged_in_user.virtualshelves.unblessed) | $raw %]; + const permissions = { + manage_agreements: [% CAN_user_erm_manage_agreements ? 1 : 0 %], + manage_licenses: [% CAN_user_erm_manage_licenses ? 1 : 0 %], + manage_packages: [% CAN_user_erm_manage_packages ? 1 : 0 %], + manage_titles: [% CAN_user_erm_manage_titles ? 1 : 0 %], + manage_providers_resources: [% CAN_user_erm_manage_providers_resources ? 1 : 0 %] + } + [% Asset.js("js/vue/dist/main.js") | $raw %] diff --git a/koha-tmpl/intranet-tmpl/prog/js/vue/components/ERM/ERMMain.vue b/koha-tmpl/intranet-tmpl/prog/js/vue/components/ERM/ERMMain.vue index e06683ed2c..714575c621 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/vue/components/ERM/ERMMain.vue +++ b/koha-tmpl/intranet-tmpl/prog/js/vue/components/ERM/ERMMain.vue @@ -1,5 +1,10 @@