From 5bff77174d6593e40af13e857fd30c441f1d99d5 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 2 Sep 2025 10:17:10 +0200 Subject: [PATCH] Bug 40684: Adjust permissions for vendors The acquisition config route should be accessible to users with at least one acquisition subpermission or erm permission. The list vendors route should be accessible to users with the erm permission. --- api/v1/swagger/paths/acquisitions_vendors.yaml | 7 ++++--- api/v1/swagger/paths/acquisitions_vendors_config.yaml | 3 ++- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/api/v1/swagger/paths/acquisitions_vendors.yaml b/api/v1/swagger/paths/acquisitions_vendors.yaml index a7ba8450f62..73839cd3423 100644 --- a/api/v1/swagger/paths/acquisitions_vendors.yaml +++ b/api/v1/swagger/paths/acquisitions_vendors.yaml @@ -78,9 +78,10 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - acquisition: - - vendors_manage - - marc_order_manage + - acquisition: + - vendors_manage + - marc_order_manage + - erm: 1 post: x-mojo-to: Acquisitions::Vendors#add operationId: addVendor diff --git a/api/v1/swagger/paths/acquisitions_vendors_config.yaml b/api/v1/swagger/paths/acquisitions_vendors_config.yaml index 4bc3e814ece..e585309a5f3 100644 --- a/api/v1/swagger/paths/acquisitions_vendors_config.yaml +++ b/api/v1/swagger/paths/acquisitions_vendors_config.yaml @@ -35,4 +35,5 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - acquisition: 1 + - acquisition: '*' + - erm: 1 -- 2.34.1