From fd8afa071aec8e4bcb777f77eedd62ba6356ee3b Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 2 Sep 2025 10:17:10 +0200 Subject: [PATCH] Bug 40684: Adjust permissions for vendors The acquisition config route should be accessible to users with at least one acquisition subpermission or erm permission. The list vendors route should be accessible to users with the erm permission. Signed-off-by: Nick Clemens --- api/v1/swagger/paths/acquisitions_vendors.yaml | 7 ++++--- api/v1/swagger/paths/acquisitions_vendors_config.yaml | 3 ++- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/api/v1/swagger/paths/acquisitions_vendors.yaml b/api/v1/swagger/paths/acquisitions_vendors.yaml index a7ba8450f62..73839cd3423 100644 --- a/api/v1/swagger/paths/acquisitions_vendors.yaml +++ b/api/v1/swagger/paths/acquisitions_vendors.yaml @@ -78,9 +78,10 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - acquisition: - - vendors_manage - - marc_order_manage + - acquisition: + - vendors_manage + - marc_order_manage + - erm: 1 post: x-mojo-to: Acquisitions::Vendors#add operationId: addVendor diff --git a/api/v1/swagger/paths/acquisitions_vendors_config.yaml b/api/v1/swagger/paths/acquisitions_vendors_config.yaml index 4bc3e814ece..e585309a5f3 100644 --- a/api/v1/swagger/paths/acquisitions_vendors_config.yaml +++ b/api/v1/swagger/paths/acquisitions_vendors_config.yaml @@ -35,4 +35,5 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - acquisition: 1 + - acquisition: '*' + - erm: 1 -- 2.39.5