Bug 31555

Summary: Getting holds via REST API needs edit_borrowers permission
Product: Koha Reporter: Johanna Räisä <johanna.raisa>
Component: REST APIAssignee: Johanna Räisä <johanna.raisa>
Status: CLOSED FIXED QA Contact: Kyle M Hall <kyle>
Severity: enhancement    
Priority: P5 - low CC: kyle, lucas, tomascohen
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.11.00
Attachments: Bug 31555: change holds GET permission to place_holds
Bug 31555: change holds GET permission to place_holds
Bug 31555: change holds GET permission to place_holds

Description Johanna Räisä 2022-09-13 12:07:41 UTC
Permissions on holds GET endpoint and request.pl are different. Staff member can see holds with place_holds permission and but via REST API it is blocked. Also a staff member can see and modify holds on patron's page without edit_borrowers permission. The GET endpoint should use place_holds permission to be more consistent.
Comment 1 Johanna Räisä 2022-09-14 06:25:39 UTC
Created attachment 140611 [details] [review]
Bug 31555: change holds GET permission to place_holds

This patch changes holds' GET REST API endpoint permission
to place_holds to match with request.pl

Test plan:
1) prove t/db_dependent/api/v1/holds.t

Sponsored-by: Koha-Suomi Oy
Comment 2 David Nind 2022-09-14 12:47:09 UTC
Created attachment 140630 [details] [review]
Bug 31555: change holds GET permission to place_holds

This patch changes holds' GET REST API endpoint permission
to place_holds to match with request.pl

Test plan:
1) prove t/db_dependent/api/v1/holds.t

Sponsored-by: Koha-Suomi Oy

Signed-off-by: David Nind <david@davidnind.com>
Comment 3 Kyle M Hall 2022-10-07 14:04:04 UTC
Created attachment 141503 [details] [review]
Bug 31555: change holds GET permission to place_holds

This patch changes holds' GET REST API endpoint permission
to place_holds to match with request.pl

Test plan:
1) prove t/db_dependent/api/v1/holds.t

Sponsored-by: Koha-Suomi Oy

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 4 Tomás Cohen Arazi 2022-10-11 14:19:37 UTC
Our permissions need a revamp (i.e. we should have individual permissions for each hold action).
Comment 5 Tomás Cohen Arazi 2022-10-11 14:21:40 UTC
Pushed to master for 22.11.

Nice work everyone, thanks!