From 4f1a57f4699c9cffdff2f88e1678ef0f3f4015ea Mon Sep 17 00:00:00 2001
From: Thibaud Guillot <thibaud.guillot@biblibre.com>
Date: Thu, 30 Nov 2023 15:14:42 +0100
Subject: [PATCH] Bug 30230: Add new 'list_borrowers' permission

When a patron search is performed only a user with edit_borrowers
permission can search by name. Search can works only with cardnumber but
it makes searching less intuitive I think.

So, as mentioned in the discussion, I've added a new 'list_borrowers' permission,
completely independent of 'edit_borrowers', so that I can search for a member via the interface
and get the results. In addition to the permission to perform check in and checkouts, this no longer poses an obstacle to simple use.

Test plan:

1) Check with a user without 'edit_borrowers' permission that the patron search can only be performed with cardnumber
2) Apply this patch
3) Make the updatedatabase to add new 'list_borrowers' permissions
4) Set 'list_borrowers' permission on one user and see the difference
---
 api/v1/swagger/paths/patrons.yaml                  |  1 +
 .../bug_29509_add-new-list-borrowers-permission.pl | 14 ++++++++++++++
 installer/data/mysql/mandatory/userflags.sql       |  1 +
 .../intranet-tmpl/prog/en/includes/permissions.inc |  3 +++
 .../intranet-tmpl/prog/en/modules/intranet-main.tt |  2 +-
 members/member.pl                                  |  2 +-
 members/members-home.pl                            |  2 +-
 members/moremember.pl                              |  2 +-
 8 files changed, 23 insertions(+), 4 deletions(-)
 create mode 100755 installer/data/mysql/atomicupdate/bug_29509_add-new-list-borrowers-permission.pl

diff --git a/api/v1/swagger/paths/patrons.yaml b/api/v1/swagger/paths/patrons.yaml
index cf8aa09122..3ff5be1239 100644
--- a/api/v1/swagger/paths/patrons.yaml
+++ b/api/v1/swagger/paths/patrons.yaml
@@ -397,6 +397,7 @@
         - tools: "label_creator"
         - serials: "routing"
         - acquisition: "order_manage"
+        - list_borrowers: 1
   post:
     x-mojo-to: Patrons#add
     operationId: addPatron
diff --git a/installer/data/mysql/atomicupdate/bug_29509_add-new-list-borrowers-permission.pl b/installer/data/mysql/atomicupdate/bug_29509_add-new-list-borrowers-permission.pl
new file mode 100755
index 0000000000..7f66157cf6
--- /dev/null
+++ b/installer/data/mysql/atomicupdate/bug_29509_add-new-list-borrowers-permission.pl
@@ -0,0 +1,14 @@
+use Modern::Perl;
+
+return {
+    bug_number  => "BUG_29509",
+    description => "Add new list_borrowers permission",
+    up          => sub {
+        my ($args) = @_;
+        my ( $dbh, $out ) = @$args{qw(dbh out)};
+
+        $dbh->do("INSERT IGNORE INTO userflags (bit, flag, flagdesc, defaulton) VALUES (31, 'list_borrowers', 'Search and list patrons', 0)");
+
+        say $out "Added new permission 'list_borrowers'";
+    },
+};
diff --git a/installer/data/mysql/mandatory/userflags.sql b/installer/data/mysql/mandatory/userflags.sql
index 8e9fad2526..cfc0019dff 100644
--- a/installer/data/mysql/mandatory/userflags.sql
+++ b/installer/data/mysql/mandatory/userflags.sql
@@ -28,4 +28,5 @@ INSERT INTO userflags (bit, flag, flagdesc, defaulton) VALUES
 (28, 'erm', 'Manage electronic resources', 0),
 (29, 'loggedinlibrary', 'Change logged in library', 0),
 (30, 'preservation', 'Preservation module', 0)
+(31, 'list_borrowers', 'Search and list patrons',0),
 ;
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
index 3d0af47233..2886aafb8c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc
@@ -87,6 +87,9 @@
     [%- CASE 'preservation' -%]
         <span class="main_permission preservation_permission">Manage the preservation module</span>
         <span class="permissioncode">([% name | html %])</span>
+    [%- CASE 'list_borrowers' -%]
+        <span class="main_permission list_borrowers_permission">Search and list patrons</span>
+        <span class="permissioncode">([% name | html %])</span>
     [%- END -%]
 [%- END -%]
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
index c066fe3ace..64612b4f3e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
@@ -64,7 +64,7 @@
                             </li>
                             [% END %]
 
-                            [% IF CAN_user_borrowers_edit_borrowers %]
+                            [% IF (CAN_user_borrowers_edit_borrowers) || (CAN_user_list_borrowers) %]
                             <li>
                                 <a class="icon_general icon_patrons" href="/cgi-bin/koha/members/members-home.pl"><i class="fa fa-fw fa-id-card"></i>Patrons</a>
                             </li>
diff --git a/members/member.pl b/members/member.pl
index 30ba11bc8c..ce2d9586c6 100755
--- a/members/member.pl
+++ b/members/member.pl
@@ -37,7 +37,7 @@ my ($template, $loggedinuser, $cookie)
     = get_template_and_user({template_name => "members/member.tt",
                  query => $input,
                  type => "intranet",
-                 flagsrequired => {borrowers => 'edit_borrowers'},
+                 flagsrequired => [borrowers => 'edit_borrowers', list_borrowers => 1],
                  });
 
 my $theme = $input->param('theme') || "default";
diff --git a/members/members-home.pl b/members/members-home.pl
index 22d341bbbb..c9922c2dd1 100755
--- a/members/members-home.pl
+++ b/members/members-home.pl
@@ -35,7 +35,7 @@ my ($template, $loggedinuser, $cookie, $flags)
     = get_template_and_user({template_name => "members/member.tt",
                  query => $query,
                  type => "intranet",
-                 flagsrequired => {borrowers => 'edit_borrowers'},
+                 flagsrequired => [borrowers => 'edit_borrowers', list_borrowers => 1],
                  });
 
 my $no_add = 0;
diff --git a/members/moremember.pl b/members/moremember.pl
index 7a419e9fb9..ed93f84622 100755
--- a/members/moremember.pl
+++ b/members/moremember.pl
@@ -62,7 +62,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         template_name   => $template_name,
         query           => $input,
         type            => "intranet",
-        flagsrequired   => { borrowers => 'edit_borrowers' },
+        flagsrequired   => [ borrowers => 'edit_borrowers', list_borrowers => 1 ],
     }
 );
 my $borrowernumber = $input->param('borrowernumber');
-- 
2.30.2