Bug 35953

Summary: Add delete_any_record cataloguing subpermission
Product: Koha Reporter: Wainui Witika-Park <wainuiwitikapark>
Component: Staff interfaceAssignee: Emmi Takkinen <emmi.takkinen>
Status: Needs Signoff --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: acampbell, anneli.osterman, emmi.takkinen, gmcharlt, Laura.escamilla, nick
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 35953: Add delete_any_record cataloguing subpermission
Bug 35953: Add delete_any_record cataloguing subpermission
Bug 35953: Add delete_any_record cataloguing subpermission
Works as described:
Bug 35953: Add delete_any_record cataloguing subpermission
Bug 35953: Rename delete_any_record as delete_bibliographic_records
Bug 35953: Add new permission delete_bibliographic_records for patrons with edit_catalogue permission

Description Wainui Witika-Park 2024-01-31 02:27:55 UTC

    
Comment 1 Wainui Witika-Park 2024-02-02 01:52:25 UTC
Created attachment 161720 [details] [review]
Bug 35953: Add delete_any_record cataloguing subpermission

To test:
- apply patch
- create a new test user
- give the test user "catalogue" permissions so that they can enter the staff interface
- also give the test user the "edit_catalogue" subpermission under the "editcatalogue" permission
- login to the staff interface as the test user
- do a catalogue search
- click on a result and go to their biblio details page
- notice there is an "Edit" button dropdown
- click on the "Edit" button dropdown and notice there are only 2 results
- change the permissions of the test user to also have "delete_any_record" subpermission under the "editcatalogue" permission
- do another catalogue search and click on the result
- click on the "Edit" button dropdown and notice there are 2 more options: "Edit record" and "Delete record"

Sponsored-by: Education Services Australia SCIS
Comment 2 Wainui Witika-Park 2024-02-07 22:38:03 UTC
Created attachment 161859 [details] [review]
Bug 35953: Add delete_any_record cataloguing subpermission

To test:
- apply patch
- create a new test user
- give the test user "catalogue" permissions so that they can enter the staff interface
- also give the test user the "edit_catalogue" subpermission under the "editcatalogue" permission
- login to the staff interface as the test user
- do a catalogue search
- click on a result and go to their biblio details page
- notice there is an "Edit" button dropdown
- click on the "Edit" button dropdown and notice there is no option to "Delete record"
- change the permissions of the test user to also have "delete_any_record" subpermission under the "editcatalogue" permission
- do another catalogue search and click on the result
- click on the "Edit" button dropdown and notice there is now an option to "Delete record"

Sponsored-by: Education Services Australia SCIS
Comment 3 Wainui Witika-Park 2024-02-14 01:04:27 UTC
Created attachment 162129 [details] [review]
Bug 35953: Add delete_any_record cataloguing subpermission

To test:
- apply patch
- create a new test user
- give the test user "catalogue" permissions so that they can enter the staff interface
- also give the test user the "edit_catalogue" subpermission under the "editcatalogue" permission
- login to the staff interface as the test user
- do a catalogue search
- click on a result and go to their biblio details page
- notice there is an "Edit" button dropdown
- click on the "Edit" button dropdown and notice there is no option to "Delete record"
- change the permissions of the test user to also have "delete_any_record" subpermission under the "editcatalogue" permission
- do another catalogue search and click on the result
- click on the "Edit" button dropdown and notice there is now an option to "Delete record"

Sponsored-by: Education Services Australia SCIS
Comment 4 Laura Escamilla 2024-02-23 19:29:32 UTC
Created attachment 162402 [details] [review]
Works as described:

Bug 35953: Add delete_any_record cataloguing subpermission

To test:
- apply patch
- create a new test user
- give the test user "catalogue" permissions so that they can enter the staff interface
- also give the test user the "edit_catalogue" subpermission under the "editcatalogue" permission
- login to the staff interface as the test user
- do a catalogue search
- click on a result and go to their biblio details page
- notice there is an "Edit" button dropdown
- click on the "Edit" button dropdown and notice there is no option to "Delete record"
- change the permissions of the test user to also have "delete_any_record" subpermission under the "editcatalogue" permission
- do another catalogue search and click on the result
- click on the "Edit" button dropdown and notice there is now an option to "Delete record"

Sponsored-by: Education Services Australia SCIS
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Comment 5 Laura Escamilla 2024-02-23 19:32:09 UTC
Agh sorry! I added my message in the incorrect spot during my sign off, but it works as described!
Comment 6 Nick Clemens (kidclamp) 2024-03-29 20:23:06 UTC
Can we get some explanation here on what the purpose is?

If I understand, this is to remove 'deletion' from 'edit_catalogue' and make it a new standalone permission?

If correct we also need to grant the permission existing users with 'editcatalogue' in the database update

I find 'delete_any_record' confusing - edit_any_item is because there are items that can be restricted - are there records that could be restricted and not possible to delete? This plan/patch does not cover authorities, which would be implied by 'any' record.

I do see that 'acquisition->order_manage' seems to grant the ability to delete order related biblios
And the tools permissions for batch deletion allow you to delete items/bibs without cataloging permissions
Have you verified there are not other places from which a biblio can be deleted?
Comment 7 Anneli Österman 2025-05-13 11:18:13 UTC
Bug https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848 removed the ability to delete records from batch item deletion if the user does not have edit_catalogue permission. This is a problem for us because our users without edit_catalogue have used batch item deletion to delete bibliographic records. We do not want to give everyone the permission to edit catalogue because it is a job that takes lot of comptence and should not be done by those who do not know the rules. :)

So with that change, it seems that we need a new permission that allows user to delete bibliographic records and not edit them. Permission named delete_catalogue or delete_biblio_records would sound consistent to me.
Comment 8 Emmi Takkinen 2025-12-05 07:35:31 UTC
I'm assigning this to myself with permission from Wainui.
Comment 9 Emmi Takkinen 2025-12-08 11:40:28 UTC
Created attachment 190281 [details] [review]
Bug 35953: Add delete_any_record cataloguing subpermission

To test:
- apply patch
- create a new test user
- give the test user "catalogue" permissions so that they can enter the staff interface
- also give the test user the "edit_catalogue" subpermission under the "editcatalogue" permission
- login to the staff interface as the test user
- do a catalogue search
- click on a result and go to their biblio details page
- notice there is an "Edit" button dropdown
- click on the "Edit" button dropdown and notice there is no option to "Delete record"
- change the permissions of the test user to also have "delete_any_record" subpermission under the "editcatalogue" permission
- do another catalogue search and click on the result
- click on the "Edit" button dropdown and notice there is now an option to "Delete record"

Sponsored-by: Education Services Australia SCIS
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Comment 10 Emmi Takkinen 2025-12-08 11:40:51 UTC
Created attachment 190282 [details] [review]
Bug 35953: Rename delete_any_record as delete_bibliographic_records

Rename new permission for deleting bibliographic records as
delete_any_record. Also rename atomicupdate file and update it to
follow current skeleton.pl file example.

To test:
1. Apply this patch.
2. Run updatedatabase.pl.
=> Confirm this new permission was added to Koha.
3. Follow test plan from previous patch.
=> Confirm everything works as described.

Sponsored by: Koha-Suomi Oy
Comment 11 Emmi Takkinen 2025-12-08 11:41:15 UTC
Created attachment 190283 [details] [review]
Bug 35953: Add new permission delete_bibliographic_records for patrons with edit_catalogue permission

This patch adds new permission delete_bibliographic_records for
all patrons who have subpermission edit_catalogue. Patrons with
full editcatalogue permissions get permission autmatically.

To test:
1. Find patron with subpermission edit_catalogue (or add it for
any patron).
2. Apply this patch.
3. Run updatedatabase.pl.
=> Confirm patron now has also subpermission
delete_bibliographic_records.

Sponsored-by: Koha-Suomi Oy
Comment 12 Emmi Takkinen 2025-12-08 11:47:14 UTC
Made changes Nick suggested in comment 6. 

>I do see that 'acquisition->order_manage' seems to grant the ability to delete order related biblios
And the tools permissions for batch deletion allow you to delete items/bibs without cataloging permissions
Have you verified there are not other places from which a biblio can be deleted?

As Anneli mentioned in her comment, batch deletion no longer allows patrons to delete records without edit_catalogue permission. Also I don't quite understand what you mean with that last question. Even if there are other ways to delete biblio records they are most likely (as far as I can tell) tied to permissions to use different modules (like acquisition->order_manage which you mention) and therefor giving them to any patron isn't likely the best idea.