Bug 35773

Summary:	Cannot create bookings without edit_borrowers, label_creator, routing or order_manage permissions
Product:	Koha	Reporter:	Martin Renvoize (ashimema) <martin.renvoize>
Component:	Circulation	Assignee:	Martin Renvoize (ashimema) <martin.renvoize>
Status:	RESOLVED FIXED	QA Contact:	Testopia <testopia>
Severity:	normal
Priority:	P5 - low	CC:	david, fridolin.somers, gmcharlt, jonathan.druart, kyle.m.hall, lucas, magnus, nick, testopia, victor
Version:	Main
Hardware:	All
OS:	All
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:	24.05.00,23.11.04
Circulation function:
Bug Depends on:	29002
Bug Blocks:	29509
Attachments:	Bug 35773: Add manage_bookings subpermission to patron searching Bug 35773: Add manage_bookings subpermission to patron searching Bug 35773: Add manage_bookings subpermission to patron searching

Description Martin Renvoize (ashimema) 2024-01-11 15:20:51 UTC

When attempting to place a booking on an item in the catalogue a user needs several permissions:
1 - Patron search permissions (see bug 29509) [Any of "borrowers:edit_borrowers", "tools:label_creator", "serials:routing", "acquisition:order_manage"]
2 - circulate: manage_bookings
3 - circulate_ circulate_remaning_permissions

If you don't have one of the first, the loading of patrons seems dies on looking up patrons via the api

Comment 1 Martin Renvoize (ashimema) 2024-01-11 15:24:19 UTC

Created attachment 160876 [details] [review]
Bug 35773: Add manage_bookings subpermission to patron searching

This quickly fixes the issue to allowing those who have the
manage_bookings subpermission to also search for users.

It's deliberately bare as I'm keen to subsequently remove it again in
bug 29509 where we will deal with this properly.

Comment 2 Magnus Enger 2024-02-09 14:25:26 UTC

(In reply to Martin Renvoize from comment #1)
> It's deliberately bare as I'm keen to subsequently remove it again in
> bug 29509 where we will deal with this properly.

Could this bug (35773) be closed now that "Bug 29509 - GET /patrons* routes permissions excessive is "Needs Signoff"? Or is it still needed?

Comment 3 Martin Renvoize (ashimema) 2024-02-16 16:30:12 UTC

They're really meant to be applied in order Magnus. I did that so that we get this important fix in 23.11.x even if we don't backport 29509

Comment 4 David Nind 2024-02-16 21:49:28 UTC

Created attachment 162249 [details] [review]
Bug 35773: Add manage_bookings subpermission to patron searching

This quickly fixes the issue to allowing those who have the
manage_bookings subpermission to also search for users.

It's deliberately bare as I'm keen to subsequently remove it again in
bug 29509 where we will deal with this properly.

Signed-off-by: David Nind <david@davidnind.com>

Comment 5 David Nind 2024-02-16 21:55:05 UTC

Testing notes (using KTD):

1. As the koha user, set up an item for booking and place a booking - everything should work as expected:
   1.1 Enable an item to be booked:
       . Go to a record with item(s).
       . Go to the items tab.
       . Update an item so that it is bookable (Priority section, update Bookable to 'Yes'
   1.2 From the buttons above the title, select 'Place booking':
       . Choose a patron
       . Select a period (click a start and end date)
       . Submit

2. Set up another staff patron (such as Henry) so that:
   2.1 You can log in as them.
   2.2 They have these permissions:
       . Staff access, allows viewing of catalogue in staff interface (catalogue)
       . Check out and check in items (circulate) (including Manage item bookings (manage_bookings))

3. Log in as them and try to make a booking - note that when searching for the patron name (such as lisa or mary), that you get no search results and can't select a patron.

4. Apply the patch, flush_memcached, and restart everything (restart_all)

5. Try again to make a booking - you should now be able to successfully search for a patron and submit the booking.

Comment 6 Victor Grousset/tuxayo 2024-03-01 20:36:36 UTC

Created attachment 162695 [details] [review]
Bug 35773: Add manage_bookings subpermission to patron searching

This quickly fixes the issue to allowing those who have the
manage_bookings subpermission to also search for users.

It's deliberately bare as I'm keen to subsequently remove it again in
bug 29509 where we will deal with this properly.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Comment 7 Victor Grousset/tuxayo 2024-03-01 21:00:57 UTC

Works, makes sense, QA script happy, code looks good, passing QA :)

Should circulate_remaning_permissions be needed for bookings? It's the one necessary for the calendar to load in the booking form.
Even if there is something to do about it, it's not really for this ticket so still passing QA.

Comment 8 Katrin Fischer 2024-03-07 16:37:18 UTC

Pushed for 24.05!

Well done everyone, thank you!

Comment 9 Fridolin Somers 2024-03-11 10:22:23 UTC

Pushed to 23.11.x for 23.11.04

Comment 10 Lucas Gass (lukeg) 2024-03-19 20:38:19 UTC

Missing 23.05.x dependencies, no backport.