Bug 35574

Summary: Bookings page should require only manage_bookings permissions
Product: Koha Reporter: Nick Clemens (kidclamp) <nick>
Component: Staff interfaceAssignee: Nick Clemens (kidclamp) <nick>
Status: RESOLVED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: fridolin.somers, gmcharlt, lucas, martin.renvoize, tomascohen
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35468
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.02
Bug Depends on: 29002    
Bug Blocks:    
Attachments: Bug 35574: Bookings tab from biblio details should only require manage_bookings permission
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission
Bug 35574: Correct api permission for listing biblio specific bookings
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission
Bug 35574:Correct api permission for listing biblio specific bookings
Bug 35574: Add unit tests for api change
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission
Bug 35574: Correct api permission for listing biblio specific bookings
Bug 35574: Add unit tests for api change
Bug 35574: Don't show the link either
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission
Bug 35574: Correct api permission for listing biblio specific bookings
Bug 35574: Add unit tests for api change
Bug 35574: Don't show the link either
Bug 35574: Tidy
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission
Bug 35574: Correct api permission for listing biblio specific bookings
Bug 35574: Add unit tests for api change
Bug 35574: Don't show the link either
Bug 35574: Tidy

Description Nick Clemens (kidclamp) 2023-12-14 17:09:05 UTC
Currently it requires 'circulate => 1'
I believe it should be 'circulate => "manage_bookings"'
Comment 1 Nick Clemens (kidclamp) 2023-12-14 17:13:47 UTC
Created attachment 159851 [details] [review]
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission

TO test:
1 - Find or create a staff user
2 - Grant permissions:
    circulate: manage_bookings, circ_remaining_permissions
    catalogue
3 - Open a record details, go to items tab, mark an item as bookable
4 - Sign out and sign in as the patron above (or use a private window to sign in)
5 - Place a booking on the record located above
6 - Success
7 - Try to view the bookings tab
8 - Fail, you don't have permission
9 - Apply patch
10 - Success!
Comment 2 Martin Renvoize 2023-12-14 17:17:48 UTC
Created attachment 159852 [details] [review]
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission

TO test:
1 - Find or create a staff user
2 - Grant permissions:
    circulate: manage_bookings, circ_remaining_permissions
    catalogue
3 - Open a record details, go to items tab, mark an item as bookable
4 - Sign out and sign in as the patron above (or use a private window to sign in)
5 - Place a booking on the record located above
6 - Success
7 - Try to view the bookings tab
8 - Fail, you don't have permission
9 - Apply patch
10 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 3 Nick Clemens (kidclamp) 2023-12-14 17:44:46 UTC
Created attachment 159853 [details] [review]
Bug 35574:  Correct api permission for listing biblio specific bookings

To test:
1 - Follow above plan and apply only first patch
2 - Not the table does not load (403: Forbidden)
3 - Apply this patch
4 - Reload
5 - Success!
Comment 4 Martin Renvoize 2023-12-15 11:06:41 UTC
Created attachment 159874 [details] [review]
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission

TO test:
1 - Find or create a staff user
2 - Grant permissions:
    circulate: manage_bookings, circ_remaining_permissions
    catalogue
3 - Open a record details, go to items tab, mark an item as bookable
4 - Sign out and sign in as the patron above (or use a private window to sign in)
5 - Place a booking on the record located above
6 - Success
7 - Try to view the bookings tab
8 - Fail, you don't have permission
9 - Apply patch
10 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Martin Renvoize 2023-12-15 11:06:43 UTC
Created attachment 159875 [details] [review]
Bug 35574:Correct api permission for listing biblio specific bookings

To test:
1 - Follow above plan and apply only first patch
2 - Not the table does not load (403: Forbidden)
3 - Apply this patch
4 - Reload
5 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 6 Martin Renvoize 2023-12-15 11:06:46 UTC
Created attachment 159876 [details] [review]
Bug 35574: Add unit tests for api change

We add the corresponding unit tests for the biblio/bookings endpoint to
ensure no regressions in the future.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 7 Martin Renvoize 2023-12-15 11:07:53 UTC
Created attachment 159877 [details] [review]
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission

TO test:
1 - Find or create a staff user
2 - Grant permissions:
    circulate: manage_bookings, circ_remaining_permissions
    catalogue
3 - Open a record details, go to items tab, mark an item as bookable
4 - Sign out and sign in as the patron above (or use a private window to sign in)
5 - Place a booking on the record located above
6 - Success
7 - Try to view the bookings tab
8 - Fail, you don't have permission
9 - Apply patch
10 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 8 Martin Renvoize 2023-12-15 11:07:55 UTC
Created attachment 159878 [details] [review]
Bug 35574: Correct api permission for listing biblio specific bookings

To test:
1 - Follow above plan and apply only first patch
2 - Not the table does not load (403: Forbidden)
3 - Apply this patch
4 - Reload
5 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 9 Martin Renvoize 2023-12-15 11:07:58 UTC
Created attachment 159879 [details] [review]
Bug 35574: Add unit tests for api change

We add the corresponding unit tests for the biblio/bookings endpoint to
ensure no regressions in the future.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 10 Martin Renvoize 2023-12-15 11:12:47 UTC
Created attachment 159880 [details] [review]
Bug 35574: Don't show the link either

This patch adds the check for permission to the biblio menu item too.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 11 Nick Clemens (kidclamp) 2023-12-15 12:35:38 UTC
Created attachment 159886 [details] [review]
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission

TO test:
1 - Find or create a staff user
2 - Grant permissions:
    circulate: manage_bookings, circ_remaining_permissions
    catalogue
3 - Open a record details, go to items tab, mark an item as bookable
4 - Sign out and sign in as the patron above (or use a private window to sign in)
5 - Place a booking on the record located above
6 - Success
7 - Try to view the bookings tab
8 - Fail, you don't have permission
9 - Apply patch
10 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>


Current status: Signed Off
Comment 12 Nick Clemens (kidclamp) 2023-12-15 12:35:41 UTC
Created attachment 159887 [details] [review]
Bug 35574: Correct api permission for listing biblio specific bookings

To test:
1 - Follow above plan and apply only first patch
2 - Not the table does not load (403: Forbidden)
3 - Apply this patch
4 - Reload
5 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 13 Nick Clemens (kidclamp) 2023-12-15 12:35:43 UTC
Created attachment 159888 [details] [review]
Bug 35574: Add unit tests for api change

We add the corresponding unit tests for the biblio/bookings endpoint to
ensure no regressions in the future.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 14 Nick Clemens (kidclamp) 2023-12-15 12:35:45 UTC
Created attachment 159889 [details] [review]
Bug 35574: Don't show the link either

This patch adds the check for permission to the biblio menu item too.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 15 Nick Clemens (kidclamp) 2023-12-15 12:35:47 UTC
Created attachment 159890 [details] [review]
Bug 35574: Tidy

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 16 Tomás Cohen Arazi 2023-12-15 19:27:09 UTC
Created attachment 159896 [details] [review]
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission

TO test:
1 - Find or create a staff user
2 - Grant permissions:
    circulate: manage_bookings, circ_remaining_permissions
    catalogue
3 - Open a record details, go to items tab, mark an item as bookable
4 - Sign out and sign in as the patron above (or use a private window to sign in)
5 - Place a booking on the record located above
6 - Success
7 - Try to view the bookings tab
8 - Fail, you don't have permission
9 - Apply patch
10 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 17 Tomás Cohen Arazi 2023-12-15 19:27:16 UTC
Created attachment 159897 [details] [review]
Bug 35574: Correct api permission for listing biblio specific bookings

To test:
1 - Follow above plan and apply only first patch
2 - Not the table does not load (403: Forbidden)
3 - Apply this patch
4 - Reload
5 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 18 Tomás Cohen Arazi 2023-12-15 19:27:27 UTC
Created attachment 159898 [details] [review]
Bug 35574: Add unit tests for api change

We add the corresponding unit tests for the biblio/bookings endpoint to
ensure no regressions in the future.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 19 Tomás Cohen Arazi 2023-12-15 19:27:40 UTC
Created attachment 159899 [details] [review]
Bug 35574: Don't show the link either

This patch adds the check for permission to the biblio menu item too.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 20 Tomás Cohen Arazi 2023-12-15 19:27:55 UTC
Created attachment 159900 [details] [review]
Bug 35574: Tidy

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 21 Tomás Cohen Arazi 2023-12-15 19:28:47 UTC
Trivial fix. QA script happy. Lots of missing tests added. Yay!
Comment 22 Katrin Fischer 2023-12-18 14:25:53 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 23 Fridolin Somers 2024-01-03 14:48:59 UTC
Pushed to 23.11.x for 23.11.02
Comment 24 Lucas Gass 2024-01-04 20:21:10 UTC
Missing dependencies for 23.05.x, no backport.