From 91627b3fe91c7a2f581b2f1a9051d2897dd83632 Mon Sep 17 00:00:00 2001 From: Matt Blenkinsop Date: Fri, 17 Jan 2025 17:05:25 +0000 Subject: [PATCH] Bug 38930: Add a permissions store This patch adds a permissions store to hold a user's permissions and run checks when required Test plan: 1) Apply the patch and run the following commands a) yarn build b) restart_all 2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements 3) Note that the button for New Agreement is visible 4) Choose a random staff user and assign them the following permissions: - Staff access, allows viewing of the catalogue in staff interface (catalogue) - Manage Koha system settings (Administration panel) (parameters) - Acquisition management (acquisition) - Manage the electronic resources module (erm) These are the permissions required to access the ERM module 6) Open an incognito browser and log in as the chosen staff member with these permissions 7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work 8) Navigate to the Agreements page again, the button should not be visible 9) Back in your main browser, assign the following permission set to the user: - Create purchase suggestions (suggestions_create) 10) Hard refresh the incognito browser, the button should now be visible again --- .../prog/js/vue/stores/permissions.js | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 koha-tmpl/intranet-tmpl/prog/js/vue/stores/permissions.js diff --git a/koha-tmpl/intranet-tmpl/prog/js/vue/stores/permissions.js b/koha-tmpl/intranet-tmpl/prog/js/vue/stores/permissions.js new file mode 100644 index 00000000000..53d91f3eafa --- /dev/null +++ b/koha-tmpl/intranet-tmpl/prog/js/vue/stores/permissions.js @@ -0,0 +1,27 @@ +import { defineStore } from "pinia"; +import { APIClient } from "../fetch/api-client.js"; + +export const usePermissionsStore = defineStore("permissions", { + state: () => ({ + userPermissions: null, + }), + actions: { + isUserPermitted(operation, permissions) { + const userPermissions = permissions + ? permissions + : this.userPermissions; + if (!operation) return true; + if (!userPermissions) return false; + + return ( + userPermissions.hasOwnProperty(operation) && + userPermissions[operation] + ); + }, + async loadUserPermissions() { + const userPermissions = + await APIClient.patron.userPermissions.get(); + this.userPermissions = userPermissions.permissions; + }, + }, +}); -- 2.48.1