|
Description
Andrew Fuerste-Henry
2025-07-14 15:56:11 UTC
Sounds good to me. I think these kinds of more granular permissions restricting access to patron information are increasingly invaluable. Created attachment 187065 [details] [review] Bug 40364: Atomicupdate to add permission Created attachment 187066 [details] [review] Bug 40364: Implement holds history permission To test: 1 - enable IntranetReadingHistoryHolds system preference 2 - make some holds for a patron, confirm you can see Holds History in the patron record when logged in as a superlibrarian 3 - log in as a non-superlibrarian with edit_borrowers permission, confirm you can see holds history in pthe patron record 4 - apply patch, updatedatabase, restat_all 5 - confirm you can see holds history as a superlibrarian 6 - confirm your non-superlibrarian from step 3 was given view_holds_history permission and can view holds history 7 - remove view_holds_history permission from your user, confirm you can no longer access holds history Created attachment 187298 [details] [review] Bug 40364: Correct wording of permissions for hold history and checkout history These both said "Viewing" rather than "View" Created attachment 187305 [details] [review] Bug 40364: Correct wording of permissions for checkout and holds history Changes "Viewing" to "View." In both relevant places! Created attachment 187317 [details] [review] Bug 40364: Atomicupdate to add permission Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org> Created attachment 187318 [details] [review] Bug 40364: Implement holds history permission To test: 1 - enable IntranetReadingHistoryHolds system preference 2 - make some holds for a patron, confirm you can see Holds History in the patron record when logged in as a superlibrarian 3 - log in as a non-superlibrarian with edit_borrowers permission, confirm you can see holds history in pthe patron record 4 - apply patch, updatedatabase, restat_all 5 - confirm you can see holds history as a superlibrarian 6 - confirm your non-superlibrarian from step 3 was given view_holds_history permission and can view holds history 7 - remove view_holds_history permission from your user, confirm you can no longer access holds history Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org> Created attachment 187319 [details] [review] Bug 40364: Correct wording of permissions for checkout and holds history Changes "Viewing" to "View." In both relevant places! Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org> I think the REST API route permission needs adjustments: api/v1/swagger/paths/patrons_holds.yaml Created attachment 188394 [details] [review] Bug 40364: Correct system preference check in atomicupdate Created attachment 188395 [details] [review] Bug 40364: Update permissions for patron_holds API path |