@@ -, +, @@ their own object .. "x-koha-permission": { "allow-owner": "1", "permissions": { "borrowers": "1" } } --- Koha/REST/V1.pm | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) --- a/Koha/REST/V1.pm +++ a/Koha/REST/V1.pm @@ -105,7 +105,12 @@ sub authenticate_api_request { } if ($action_spec->{'x-koha-permission'}) { - if (C4::Auth::haspermission($user->userid, $action_spec->{'x-koha-permission'})) { + if (_allowOwner($c, $action_spec, $user)) { + return $next->($c); + } + my $permissions = $action_spec->{'x-koha-permission'}->{'permissions'}; + + if (C4::Auth::haspermission($user->userid, $permissions)) { return $next->($c); } else { @@ -121,4 +126,20 @@ sub authenticate_api_request { } } +sub _allowOwner { + my ($c, $action_spec, $user) = @_; + + my $allowOwner = $action_spec->{'x-koha-permission'}->{'allow-owner'}; + + return unless $allowOwner && $allowOwner == 1; + if ($c->param("borrowernumber")) { + return $c->param("borrowernumber") + && $user->borrowernumber == $c->param("borrowernumber"); + } + elsif ($c->req->json && $c->req->json->{"borrowernumber"}) { + return $c->req->json->{"borrowernumber"} + && $user->borrowernumber == $c->req->json->{"borrowernumber"}; + } +} + 1; --