From f97c2cef903802e83a652cbb2f499d00034e100a Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Wed, 26 Apr 2023 15:21:39 +0000 Subject: [PATCH] Bug 33363: Add separate permissions for creating and deleting suggestions There are a number of libraries that would like for their staff to be able to submit (and view existing) purchase suggestions from the borrower record, but not give the staff the ability to edit/manage/delete purchase suggestions. Test Plan: 1) Apply this patch 2) Run restart all the things! 3) Run updatedatabase 4) Verify anyone with the suggestions manage permissions now has the create and delete permissions as well 5) Verify anyone without the suggestions manage permission has not recieved the new permissions 6) Enable only the create permission for a librarian 7) Verify that librarian can only create new suggestions ( not manage or delete ) 8) Enable only the manage permission for a librarian 9) Verify that librarian can only manage existing suggestions ( not create or delete ) 10) Enable only the delete permission for a librarian 11) Verify that librarian can only delete suggestions ( not create or manage ) Signed-off-by: Michaela Sieber --- api/v1/swagger/paths/suggestions.yaml | 19 +- .../data/mysql/atomicupdate/bug_33363.pl | 16 + .../data/mysql/mandatory/userpermissions.sql | 2 + .../prog/en/includes/acquisitions-menu.inc | 2 +- .../prog/en/includes/circ-menu.inc | 2 +- .../intranet-tmpl/prog/en/includes/header.inc | 2 +- .../prog/en/includes/patron-search.inc | 2 +- .../prog/en/includes/permissions.inc | 10 + .../modules/members/purchase-suggestions.tt | 4 +- .../prog/en/modules/suggestion/suggestion.tt | 276 ++++++++++-------- members/purchase-suggestions.pl | 2 +- suggestion/suggestion.pl | 84 ++++-- t/Koha/Auth/Permissions.t | 2 + 13 files changed, 269 insertions(+), 154 deletions(-) create mode 100755 installer/data/mysql/atomicupdate/bug_33363.pl diff --git a/api/v1/swagger/paths/suggestions.yaml b/api/v1/swagger/paths/suggestions.yaml index 6e500bcf4c..2058bb82bf 100644 --- a/api/v1/swagger/paths/suggestions.yaml +++ b/api/v1/swagger/paths/suggestions.yaml @@ -41,7 +41,10 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - suggestions: suggestions_manage + suggestions: + - suggestions_manage + - suggestions_delete + - suggestions_create post: x-mojo-to: Suggestions#add operationId: addSuggestions @@ -100,7 +103,7 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - suggestions: suggestions_manage + suggestions: suggestions_create "/suggestions/{suggestion_id}": get: x-mojo-to: Suggestions#get @@ -139,7 +142,10 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - suggestions: suggestions_manage + suggestions: + - suggestions_manage + - suggestions_delete + - suggestions_create put: x-mojo-to: Suggestions#update operationId: updateSuggestion @@ -229,7 +235,7 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - suggestions: suggestions_manage + suggestions: suggestions_delete /suggestions/managers: get: x-mojo-to: Suggestions#list_managers @@ -281,4 +287,7 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - suggestions: suggestions_manage + suggestions: + - suggestions_manage + - suggestions_delete + - suggestions_create diff --git a/installer/data/mysql/atomicupdate/bug_33363.pl b/installer/data/mysql/atomicupdate/bug_33363.pl new file mode 100755 index 0000000000..46ceea7b42 --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_33363.pl @@ -0,0 +1,16 @@ +use Modern::Perl; + +return { + bug_number => "33363", + description => "Split suggestions_manage into three separate permissions for creating, updating, and deleting suggetions", + up => sub { + my ($args) = @_; + my ($dbh, $out) = @$args{qw(dbh out)}; + + $dbh->do(q{INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (12, 'suggestions_create', 'Create purchase suggestions')}); + $dbh->do(q{INSERT IGNORE INTO permissions (module_bit, code, description) VALUES (12, 'suggestions_delete', 'Update purchase suggestions')}); + + $dbh->do(q{INSERT IGNORE INTO user_permissions (borrowernumber, module_bit, code) SELECT borrowernumber, 12, 'suggestions_create' FROM borrowers WHERE flags & (1 << 2)}); + $dbh->do(q{INSERT IGNORE INTO user_permissions (borrowernumber, module_bit, code) SELECT borrowernumber, 12, 'suggestions_delete' FROM borrowers WHERE flags & (1 << 2)}); + }, +}; diff --git a/installer/data/mysql/mandatory/userpermissions.sql b/installer/data/mysql/mandatory/userpermissions.sql index 63da567fb7..2d7db7a776 100644 --- a/installer/data/mysql/mandatory/userpermissions.sql +++ b/installer/data/mysql/mandatory/userpermissions.sql @@ -83,7 +83,9 @@ INSERT INTO permissions (module_bit, code, description) VALUES (11, 'delete_invoices', 'Delete invoices'), (11, 'merge_invoices', 'Merge invoices'), (11, 'delete_baskets', 'Delete baskets'), + (12, 'suggestions_create', 'Create purchase suggestions'), (12, 'suggestions_manage', 'Manage purchase suggestions'), + (12, 'suggestions_delete', 'Delete purchase suggestions'), (13, 'edit_additional_contents', 'Write additional contents for the OPAC and staff interfaces (news and HTML customizations)'), (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'), (13, 'edit_calendar', 'Define days when the library is closed'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc index e95bd8ecde..36f86ec6e1 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-menu.inc @@ -5,7 +5,7 @@