Bug 33993

Summary:	The GET orders endpoint needs to allow users with order_receive permission
Product:	Koha	Reporter:	Martin Renvoize (ashimema) <martin.renvoize>
Component:	Acquisitions	Assignee:	Martin Renvoize (ashimema) <martin.renvoize>
Status:	RESOLVED FIXED	QA Contact:	Testopia <testopia>
Severity:	major
Priority:	P5 - low	CC:	lucas, tomascohen
Version:	Main
Hardware:	All
OS:	All
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:	23.11.00,23.05.02,22.11.08
Circulation function:
Attachments:	Bug 33993: Add order_receive to GET orders endpoints Bug 33993: Add order_receive to GET orders endpoints Bug 33993: Add order_receive to GET orders endpoints

Description Martin Renvoize (ashimema) 2023-06-13 08:44:09 UTC

We're now using the API for loading orders in the order receive page. As such, we need to allow the GET orders endpoint to function with that permission too.

We have customers where they restrict staff to either 'ordering' or 'receiving' using permissions.. as we require 'order_manage' or 'order_manage_all' their users with just 'order_recieve' get a 403 when the orders table attempts to load on receive pages.

Comment 1 Martin Renvoize (ashimema) 2023-06-13 08:46:32 UTC

Created attachment 152290 [details] [review]
Bug 33993: Add order_receive to GET orders endpoints

This adds order_receive to the list of permissions that allow the
endpoint to return orders.

Comment 2 Lucas Gass (lukeg) 2023-06-13 19:52:55 UTC

I am testing using this plan:

1. Have a user with just the 'order_recieve' permission. Log in, or use PostMan, to hit '/api/v1/acquisitions/orders/'.
2. You don't have permission to view the page
3. Give the user the 'order_recieve' permission. Hit '/api/v1/acquisitions/orders/'. Now you should see the response.

Comment 3 Lucas Gass (lukeg) 2023-06-13 19:53:31 UTC

Created attachment 152324 [details] [review]
Bug 33993: Add order_receive to GET orders endpoints

This adds order_receive to the list of permissions that allow the
endpoint to return orders.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Comment 4 Martin Renvoize (ashimema) 2023-06-23 08:44:54 UTC

Created attachment 152625 [details] [review]
Bug 33993: Add order_receive to GET orders endpoints

This adds order_receive to the list of permissions that allow the
endpoint to return orders.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Sharon Dugdale <Sharon.Dugdale@cumberland.gov.uk>

Comment 5 Martin Renvoize (ashimema) 2023-06-23 08:45:30 UTC

Tiny bug.. now also signed off by the customer who reported the problem.

I think we can safety PQA this ;)

Comment 6 Tomás Cohen Arazi (tcohen) 2023-06-23 12:46:18 UTC

Pushed to master for 23.11.

Nice work everyone, thanks!

Comment 7 Martin Renvoize (ashimema) 2023-07-17 12:46:02 UTC

Thanks for all the hard work!

Pushed to 23.05.x for the next release

Comment 8 Pedro Amorim 2023-07-18 10:50:31 UTC

Nice work everyone!

Pushed to 22.11.x for next release