From dabbf7d1125cadac45d31af97d00d2dd5c1ff74c Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Mon, 22 Jan 2024 16:49:56 +0000
Subject: [PATCH] Bug 29509: Update swagger specification and add permissions
 to users

This patch removes the 'edit_borrowers', 'manage_bookings',
'lable_creator', 'routing' and 'order_manage' permissions from the list
of options in the patrons list endpoint.

We then assign the new 'list_borrowers' permission to any users who have
those removed permissions
---
 api/v1/swagger/paths/patrons.yaml             |  5 --
 .../data/mysql/atomicupdate/bug_29509.pl      | 61 +++++++++++++++++++
 2 files changed, 61 insertions(+), 5 deletions(-)
 create mode 100755 installer/data/mysql/atomicupdate/bug_29509.pl

diff --git a/api/v1/swagger/paths/patrons.yaml b/api/v1/swagger/paths/patrons.yaml
index 641ba4f1ae1..02894e2dd05 100644
--- a/api/v1/swagger/paths/patrons.yaml
+++ b/api/v1/swagger/paths/patrons.yaml
@@ -394,11 +394,6 @@
     x-koha-authorization:
       permissions:
         - borrowers: "list_borrowers"
-        - borrowers: "edit_borrowers"
-        - circulate: "manage_bookings"
-        - tools: "label_creator"
-        - serials: "routing"
-        - acquisition: "order_manage"
   post:
     x-mojo-to: Patrons#add
     operationId: addPatron
diff --git a/installer/data/mysql/atomicupdate/bug_29509.pl b/installer/data/mysql/atomicupdate/bug_29509.pl
new file mode 100755
index 00000000000..5de47cf318b
--- /dev/null
+++ b/installer/data/mysql/atomicupdate/bug_29509.pl
@@ -0,0 +1,61 @@
+use Modern::Perl;
+use Array::Utils qw( array_minus );
+
+return {
+    bug_number  => "29509",
+    description => "Update users with list_borrowers permission where required",
+    up          => sub {
+        my ($args) = @_;
+        my ( $dbh, $out ) = @$args{qw(dbh out)};
+
+        # Users to exclude from update, (superlibrarians or borrowers flags)
+        my $sth = $dbh->prepare("SELECT borrowernumber FROM borrowers WHERE flags = 0 OR (flags & 4) > 0");
+        $sth->execute();
+        my @exclusions = map { $_->[0] } @{ $sth->fetchall_arrayref };
+
+        # Prepare insert
+        my $insert_sth =
+            $dbh->prepare("INSERT IGNORE INTO user_permissions (borrower_number, module_bit, code) VALUES (?, ?, ?)");
+
+        # Check for 'borrowers' or 'borrowers > edit_borrowers' permission
+        my $sth2 = $dbh->prepare("SELECT borrowernumber FROM user_permissions WHERE code = 'edit_borrowers'");
+        $sth2->execute();
+        my @edit_borrowers = map { $_->[0] } @{ $sth2->fetchall_arrayref };
+        my @rows_to_insert = ( map { [ $_, 4, "list_borrowers" ] } array_minus( @edit_borrowers, @exclusions ) );
+        $insert_sth->execute_array( {}, @rows_to_insert );
+        say $out "list_borrowers added to all users with edit_borrowers";
+
+        # Check for 'circulate' or 'circulate > manage_bookings' permission
+        my $sth3 = $dbh->prepare("SELECT borrowernumber FROM user_permissions WHERE code = 'manage_bookings'");
+        $sth3->execute();
+        my @manage_bookings = map { $_->[0] } @{ $sth3->fetchall_arrayref };
+        @rows_to_insert = ( map { [ $_, 4, "list_borrowers" ] } array_minus( @manage_bookings, @exclusions ) );
+        $insert_sth->execute_array( {}, @rows_to_insert );
+        say $out "list_borrowers added to all users with manage_bookings";
+
+        # Check for 'tools' or 'tools > label_creator' permission
+        my $sth4 = $dbh->prepare("SELECT borrowernumber FROM user_permissions WHERE code = 'label_creator'");
+        $sth4->execute();
+        my @label_creator = map { $_->[0] } @{ $sth4->fetchall_arrayref };
+        @rows_to_insert = ( map { [ $_, 4, "list_borrowers" ] } array_minus( @label_creator, @exclusions ) );
+        $insert_sth->execute_array( {}, @rows_to_insert );
+
+        say $out "list_borrowers added to all users with label_creator";
+
+        # Check for 'serials' or 'serials > routing' permission
+        my $sth5 = $dbh->prepare("SELECT borrowernumber FROM user_permissions WHERE code = 'routing'");
+        $sth5->execute();
+        my @routing = map { $_->[0] } @{ $sth5->fetchall_arrayref };
+        @rows_to_insert = ( map { [ $_, 4, "list_borrowers" ] } array_minus( @routing, @exclusions ) );
+        $insert_sth->execute_array( {}, @rows_to_insert );
+        say $out "list_borrowers added to all users with routing";
+
+        # Check for 'acquisitions' or 'acquisitions > order_manage' permission
+        my $sth6 = $dbh->prepare("SELECT borrowernumber FROM user_permissions WHERE code = 'order_manage'");
+        $sth6->execute();
+        my @order_manage = map { $_->[0] } @{ $sth6->fetchall_arrayref };
+        @rows_to_insert = ( map { [ $_, 4, "list_borrowers" ] } array_minus( @order_manage, @exclusions ) );
+        $insert_sth->execute_array( {}, @rows_to_insert );
+        say $out "list_borrowers added to all users with order_manage";
+    },
+};
-- 
2.43.0