Bug 40115

Summary: Extensive acquisition permissions needed to search vendors
Product: Koha Reporter: Christian Nelson <christian.nelson>
Component: AcquisitionsAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: anneli.osterman, nugged
Version: 25.05   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Christian Nelson 2025-06-11 09:27:11 UTC
In the acquitions module (acqui-home.pl) when searching for vendors (eg. for receiving orders) the user gets the message "Something went wrong: Error: Authorization failure. Missing required permission(s)." and the page stays on loading forever. This happens unless the user has extensive acquisition permissions, such as managing budget plannings (planning_manage). It should be possible to perform routine acquitions tasks such as creating baskets and receiving orders without permissions to modify budgets.

Koha version: 25.05.00.000
Comment 1 Andrii Nugged 2025-06-16 16:18:28 UTC
The issue might be here:

api/v1/swagger/paths/acquisitions_vendors_config.yaml:36-38

    x-koha-authorization:
      permissions:
        acquisition: 1

If we compare with the pre-Vue version in acqui/vendors.pl:35:

        flagsrequired => { acquisition => '*' },

So the YAML should be:

        acquisition: "*"

to allow to GET /acquisitions/vendors/config if user has ANY of sub-parameters in "acquisition" permissions group.