Bug 16815

Summary: API routes to list, create, update, delete holds need permissions
Product: Koha Reporter: Kyle M Hall <kyle>
Component: Hold requestsAssignee: Julian Maurice <julian.maurice>
Status: RESOLVED DUPLICATE QA Contact: Testopia <testopia>
Severity: critical    
Priority: P5 - low CC: gmcharlt, lari.taskula, tomascohen
Version: 16.05   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14868
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 13903    
Bug Blocks:    

Description Kyle M Hall 2016-06-27 14:15:15 UTC
The REST api for holds CRUD should require hold permissions! I think it needs reserveforothers and it's subpermissions implemented.
Comment 1 Lari Taskula 2016-06-30 15:05:58 UTC
This issue is fixed in Bug 14868, however it does not directly duplicate this bug since Bug 14868 (Swagger2-driven permission checking) is last of three changes that modify the Swagger-specification aiming towards more split specification including the introduction of permissions in Path-object. Here are short descriptions for the three Bugs:

1. Bug 16212 adds a "minifier"-script to Swagger that fixes problems the current way of splitting swagger.json in master has caused; the problem is that splitting the "definitions" to $ref: definitions/index.json is not allowed (same with Paths-object) in Swagger. If we use a script to resolve the references in swagger.json, it becomes valid. You can see this problem if you try to validate our master Swagger specification with online.swagger.io validator.
2. Bug 16699 (depends on 16212) splits swagger.json further than what has already been done, and uses the minifier to make this type of split allowed.
3. Bug 14868 fixes the issue reported in this bug, but is dependant on Bug 16699.

It would be cool if someone took a look at them. I'm adding it as See Also. :)
Comment 2 Tomás Cohen Arazi 2016-08-23 14:15:10 UTC
I mark it for 16.05 as the REST api has been enabled in that branch's latest release. And the proper solution for master what Lari mentions: bug 14868.

I'll start working on it.
Comment 3 Tomás Cohen Arazi 2016-12-14 14:05:38 UTC

*** This bug has been marked as a duplicate of bug 14868 ***