Bug 38914

Summary: REST API account endpoint permissions should not require edit_borrowers permission
Product: Koha Reporter: Nick Clemens (kidclamp) <nick>
Component: REST APIAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: martin.renvoize, tomascohen
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Nick Clemens (kidclamp) 2025-01-16 21:25:17 UTC
The patrons endpoint now requires only 'list_borrowers' for GET requests

The patrons/account endpoint requires "edit_borrowers" and "updatecharges:remaining_permissions" which is really view only

The edit_borrowers in the second should be "list_borrowers" so that outside systems can view charges without needing to be able to edit patrons.