From d672d0d73af3b7e680d80f692effe91eb7f26a5c Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Fri, 15 Dec 2023 11:37:43 +0000 Subject: [PATCH] Bug 35469: Add 'manage_bookings' subpermission to /checkouts This patch adds the 'manage_bookings' permission to allow fetching of checkouts on the API should the user have 'manage_bookings' but not have 'circulate_remaining_permissions' Signed-off-by: Nick Clemens --- api/v1/swagger/paths/checkouts.yaml | 3 ++- t/db_dependent/api/v1/checkouts.t | 25 ++++++++++++++++++++++++- 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/api/v1/swagger/paths/checkouts.yaml b/api/v1/swagger/paths/checkouts.yaml index f38c1e25e65..5964f61cb74 100644 --- a/api/v1/swagger/paths/checkouts.yaml +++ b/api/v1/swagger/paths/checkouts.yaml @@ -59,7 +59,8 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - circulate: circulate_remaining_permissions + - circulate: circulate_remaining_permissions + - circulate: manage_bookings post: x-mojo-to: Checkouts#add operationId: addCheckout diff --git a/t/db_dependent/api/v1/checkouts.t b/t/db_dependent/api/v1/checkouts.t index 8c16f1f88e0..57525f4b5db 100755 --- a/t/db_dependent/api/v1/checkouts.t +++ b/t/db_dependent/api/v1/checkouts.t @@ -17,7 +17,7 @@ use Modern::Perl; -use Test::More tests => 105; +use Test::More tests => 108; use Test::MockModule; use Test::Mojo; use t::lib::Mocks; @@ -70,6 +70,29 @@ $t->get_ok( "//$userid:$password@/api/v1/checkouts?patron_id=$notexisting_patron ->status_is(200) ->json_is([]); +my $bookings_librarian = $builder->build_object( + { + class => 'Koha::Patrons', + value => { flags => 0 } # no additional permissions + } +); +$builder->build( + { + source => 'UserPermission', + value => { + borrowernumber => $bookings_librarian->borrowernumber, + module_bit => 1, + code => 'manage_bookings', + }, + } +); +$bookings_librarian->set_password( { password => $password, skip_validation => 1 } ); +my $bookings_userid = $bookings_librarian->userid; + +$t->get_ok( "//$bookings_userid:$password@/api/v1/checkouts?patron_id=$patron_id" ) + ->status_is(200, 'manage_bookings allows checkouts access') + ->json_is([]); + Koha::CirculationRules->set_rules( { categorycode => undef, -- 2.30.2