Summary: | Access to ERM module requires 'erm' permission and 'vendors_manage' acquisition sub-permission | ||
---|---|---|---|
Product: | Koha | Reporter: | Pedro Amorim <pedro.amorim> |
Component: | ERM | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | In Discussion --- | QA Contact: | |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | catrina, jonathan.druart, jonathan.field, martin.renvoize, maude.boudreau, pedro.amorim, tomascohen |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33606 | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: | ||
Bug Depends on: | |||
Bug Blocks: | 32968 |
Description
Pedro Amorim
2023-02-15 16:42:16 UTC
To add to this list, and likely to update the title of this bug sometime in the future: In order to add a user to an agreement (and license), the permission edit_borrowers is required, or a 403 is returned. Ideally, having just the 'erm' permission should be enough to be granted correct access to all of ERM. (In reply to Pedro Amorim from comment #1) > In order to add a user to an agreement (and license), the permission > edit_borrowers is required, or a 403 is returned. Confirmed "GET /api/v1/app.pl/api/v1/patrons/5 HTTP/1.1" 403 - "http://kohadev-intra.mydnsname.org:8081/cgi-bin/koha/erm/licenses/add" "Mozilla/5.0 (X11; Linux x86_64) (In reply to Jonathan Druart from comment #2) > (In reply to Pedro Amorim from comment #1) > > In order to add a user to an agreement (and license), the permission > > edit_borrowers is required, or a 403 is returned. > > Confirmed > > "GET /api/v1/app.pl/api/v1/patrons/5 HTTP/1.1" 403 - > "http://kohadev-intra.mydnsname.org:8081/cgi-bin/koha/erm/licenses/add" > "Mozilla/5.0 (X11; Linux x86_64) So basically we need a new endpoint /erm/users/:patron_id, or tweak includes/patron-search.inc to inject all patron's info on the opener's DOM instead of just the id (search for "selected_patron_id"). Is this resolved with 33606? (In reply to Catrina Berka from comment #4) > Is this resolved with 33606? It's not. These are different issues. Bug 33606 updated the way we fetch the system preferences related to ERM. The reproduce instructions in this current bug 32971 still apply, i.e. the issue is still there. The issue is caused by the ERM module fetching vendors through the /api/v1/acquisitions/vendors endpoint. But that endpoint requires the acquisitions permission, specifically the vendors_manage sub-permission. Just ran into this testing 33606. In the serials module you can still use existing vendors and link them to subscriptions without having vendor_manage. I think the same behaviour would make sense for the ERM module as well. |