From 3366de06eaf8a257fe3636ef95512f26c8c0aa55 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Wed, 25 Feb 2026 12:00:46 +0000 Subject: [PATCH] Bug 10190: correction to x-koha-authorization on /circulation_rules/config The config endpoint is used exclusively by the Circulation Triggers Vue app, which is gated on parameters/manage_circ_rules. Using acquisition/'*' and erm/1 was inconsistent copy-paste from an unrelated endpoint and would 403 circ-rules admins while granting access to unrelated module users. --- api/v1/swagger/paths/circulation_rules_config.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/api/v1/swagger/paths/circulation_rules_config.yaml b/api/v1/swagger/paths/circulation_rules_config.yaml index a4624ff8111..b6f94e6918f 100644 --- a/api/v1/swagger/paths/circulation_rules_config.yaml +++ b/api/v1/swagger/paths/circulation_rules_config.yaml @@ -35,5 +35,4 @@ $ref: "../swagger.yaml#/definitions/error" x-koha-authorization: permissions: - - acquisition: '*' - - erm: 1 + - parameters: manage_circ_rules -- 2.53.0