Bug 40684

Summary: Permission error for vendors if user has not full acquisition module permission
Product: Koha Reporter: Michaela Sieber <michaela.sieber>
Component: AcquisitionsAssignee: Jonathan Druart <jonathan.druart>
Status: Pushed to stable --- QA Contact: Matt Blenkinsop <matt.blenkinsop>
Severity: major    
Priority: P5 - low CC: caroline.cyr-la-rose, cbrannon, Chip.Halvorsen, jonathan.druart, katrin.fischer, lucas, matt.blenkinsop, mspinney, nick, paul.derscheid, rcoert
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38446
GIT URL: Change sponsored?: ---
Patch complexity: Trivial patch Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
25.11.00,25.05.04
Circulation function:
Bug Depends on: 38010    
Bug Blocks: 40868    
Attachments: Bug 40684: Adjust permissions for vendors
Bug 40684: Adjust permissions for vendors
Bug 40684: Adjust permissions for vendors

Description Michaela Sieber 2025-08-21 15:53:43 UTC
With a restricted libarian account (only some acq permissions) it is not possible to see or edit vendors in acquisition . 
The error message "Something went wrong: Error: Authorization failure. Missing required permission(s)." appears.

The patron would need the acquisition permissions which includes budget permissions among other things, otherwise the API blocks the request.


To recreate:
1. Log in as superlibrarian
2. Search for a user, for example borrowernumber=17
7. Give permissions for catalogue (staff access) and manage_vendors
8. Log in with this account
9. Go to Acquisition module
10. Click on Search Vendors
Check that the error message mentioned above appears
Comment 1 Katrin Fischer 2025-08-25 13:08:58 UTC
I think this is major as it could be a very big issue for libraries that don't want to give the _all permissions in a consortial setting. But also if someone only needs vendors for working with the serials or ERM module.

Updating severity.
Comment 2 Jonathan Druart 2025-09-02 08:18:54 UTC
Created attachment 186027 [details] [review]
Bug 40684: Adjust permissions for vendors

The acquisition config route should be accessible to users
with at least one acquisition subpermission or erm permission.

The list vendors route should be accessible to users with the erm
permission.
Comment 3 Jonathan Druart 2025-09-02 08:20:06 UTC
This patch fixed the original problem, but there are more to fix it seems. the erm module is still not loading properly (I guess it can be fixed later).

How do you feel about this patch, Matt?
Comment 4 Nick Clemens (kidclamp) 2025-09-24 14:52:55 UTC
Created attachment 186889 [details] [review]
Bug 40684: Adjust permissions for vendors

The acquisition config route should be accessible to users
with at least one acquisition subpermission or erm permission.

The list vendors route should be accessible to users with the erm
permission.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 5 Matt Blenkinsop 2025-09-24 14:55:29 UTC
Created attachment 186891 [details] [review]
Bug 40684: Adjust permissions for vendors

The acquisition config route should be accessible to users
with at least one acquisition subpermission or erm permission.

The list vendors route should be accessible to users with the erm
permission.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Comment 6 Matt Blenkinsop 2025-09-24 14:56:06 UTC
I think this is the best solution for now, PQA
Comment 7 Lucas Gass (lukeg) 2025-09-24 15:26:41 UTC
Nice work everyone!

Pushed to main for 25.11
Comment 8 Christopher Brannon 2025-09-24 15:58:10 UTC
Can this be back ported to 25.05?
Comment 9 Rebecca Coert 2025-09-24 20:33:30 UTC
(In reply to Christopher Brannon from comment #8)
> Can this be back ported to 25.05?

I second this request.  Thank you for considering!
Comment 10 Michelle Spinney 2025-09-24 21:43:56 UTC
+1 Katrin's comment re: issue severity for consortial settings
+1 on the backporting request
Comment 11 Paul Derscheid 2025-09-25 16:30:35 UTC
Nice work everyone!

Pushed to 25.05.x