Bug 40364

Summary: Add permission for viewing patron holds history
Product: Koha Reporter: Andrew Fuerste-Henry <andrew>
Component: CirculationAssignee: Andrew Fuerste-Henry <andrew>
Status: Signed Off --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dcook, gmcharlt, jonathan.druart, kebliss, kyle, trevor.diamond
Version: Main   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Crowdfunding goal: 0
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 32682    
Bug Blocks:    
Attachments: Bug 40364: Atomicupdate to add permission
Bug 40364: Implement holds history permission
Bug 40364: Correct wording of permissions for hold history and checkout history
Bug 40364: Correct wording of permissions for checkout and holds history
Bug 40364: Atomicupdate to add permission
Bug 40364: Implement holds history permission
Bug 40364: Correct wording of permissions for checkout and holds history
Bug 40364: Correct system preference check in atomicupdate
Bug 40364: Update permissions for patron_holds API path

Description Andrew Fuerste-Henry 2025-07-14 15:56:11 UTC
Bug 32682 is adding a permission for the ability to view patron checkout history.
We also need a parallel permission for patron holds history. We should make it so when IntranetReadingHistoryHolds is enabled, users with this new permission can see patron hold history but users without the permission cannot. When IntranetReadingHistoryHolds is disabled, no users should be able to see patron hold history.
Comment 1 David Cook 2025-07-14 23:12:22 UTC
Sounds good to me. I think these kinds of more granular permissions restricting access to patron information are increasingly invaluable.
Comment 2 Andrew Fuerste-Henry 2025-09-29 20:10:16 UTC
Created attachment 187065 [details] [review]
Bug 40364: Atomicupdate to add permission
Comment 3 Andrew Fuerste-Henry 2025-09-29 20:10:19 UTC
Created attachment 187066 [details] [review]
Bug 40364: Implement holds history permission

To test:
1 - enable IntranetReadingHistoryHolds system preference
2 - make some holds for a patron, confirm you can see Holds History in the patron record when logged in as a superlibrarian
3 - log in as a non-superlibrarian with edit_borrowers permission, confirm you can see holds history in pthe patron record
4 - apply patch, updatedatabase, restat_all
5 - confirm you can see holds history as a superlibrarian
6 - confirm your non-superlibrarian from step 3 was given view_holds_history permission and can view holds history
7 - remove view_holds_history permission from your user, confirm you can no longer access holds history
Comment 4 Andrew Fuerste-Henry 2025-10-02 15:59:37 UTC
Created attachment 187298 [details] [review]
Bug 40364: Correct wording of permissions for hold history and checkout history

These both said "Viewing" rather than "View"
Comment 5 Andrew Fuerste-Henry 2025-10-02 16:23:54 UTC
Created attachment 187305 [details] [review]
Bug 40364: Correct wording of permissions for checkout and holds history

Changes "Viewing" to "View." In both relevant places!
Comment 6 Andrew Fuerste-Henry 2025-10-02 18:49:19 UTC
Created attachment 187317 [details] [review]
Bug 40364: Atomicupdate to add permission

Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Comment 7 Andrew Fuerste-Henry 2025-10-02 18:49:22 UTC
Created attachment 187318 [details] [review]
Bug 40364: Implement holds history permission

To test:
1 - enable IntranetReadingHistoryHolds system preference
2 - make some holds for a patron, confirm you can see Holds History in the patron record when logged in as a superlibrarian
3 - log in as a non-superlibrarian with edit_borrowers permission, confirm you can see holds history in pthe patron record
4 - apply patch, updatedatabase, restat_all
5 - confirm you can see holds history as a superlibrarian
6 - confirm your non-superlibrarian from step 3 was given view_holds_history permission and can view holds history
7 - remove view_holds_history permission from your user, confirm you can no longer access holds history

Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Comment 8 Andrew Fuerste-Henry 2025-10-02 18:49:24 UTC
Created attachment 187319 [details] [review]
Bug 40364: Correct wording of permissions for checkout and holds history

Changes "Viewing" to "View." In both relevant places!

Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Comment 9 Jonathan Druart 2025-10-07 09:56:07 UTC
I think the REST API route permission needs adjustments:

api/v1/swagger/paths/patrons_holds.yaml
Comment 10 Andrew Fuerste-Henry 2025-10-23 19:46:22 UTC
Created attachment 188394 [details] [review]
Bug 40364: Correct system preference check in atomicupdate
Comment 11 Andrew Fuerste-Henry 2025-10-23 19:46:24 UTC
Created attachment 188395 [details] [review]
Bug 40364: Update permissions for patron_holds API path