Bug 41751

Summary: Cash register transaction history returns 403 for users with only anonymous_refund permission
Product: Koha Reporter: Martin Renvoize (ashimema) <martin.renvoize>
Component: Point of SaleAssignee: Martin Renvoize (ashimema) <martin.renvoize>
Status: Needs Signoff --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: hdunne-howrie, martin.renvoize, sally.healey, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: Sponsored Comma delimited list of Sponsors: OpenFifth <https://openfifth.co.uk/>
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 24082    
Bug Blocks:    
Attachments: Bug 41751: Allow anonymous_refund permission to access cashups API

Description Martin Renvoize (ashimema) 2026-02-02 13:51:13 UTC
When a user has the cash_management > anonymous_refund permission but NOT the cashup permission, they can access the cash register transaction history page (/cgi-bin/koha/pos/register.pl), but the cashups table fails to load with a 403 error.

Steps to Reproduce:
1. Create a staff user with only cash_management > anonymous_refund permission (not cashup)
2. Navigate to Point of Sale > Transaction history for any cash register
3. Observe that the page loads but the cashups table shows a 403 error

Expected Behavior:
The cashups table should load successfully since the user has permission to view the page.

Actual Behavior:
The API endpoint /api/v1/cash_registers/{id}/cashups returns 403 Forbidden because it only checks for cashup permission.
Comment 1 Martin Renvoize (ashimema) 2026-02-02 14:01:54 UTC
Created attachment 192320 [details] [review]
Bug 41751: Allow anonymous_refund permission to access cashups API

The cash register transaction history page (pos/register.pl) allows
access with either cashup OR anonymous_refund permission, but the
API endpoints for fetching cashups only checked for cashup permission.

This caused a 403 error when users with only anonymous_refund permission
tried to view the transaction history page, as the cashups table failed
to load.

This patch updates the API permissions for:
- GET /cash_registers/{id}/cashups
- GET /cashups/{id}

to accept either cashup or anonymous_refund permission, matching the
page access logic.

Test plan:
1. Create a staff user with only cash_management > anonymous_refund
   permission (not cashup)
2. Navigate to Point of Sale > Transaction history for any cash register
3. Verify the cashups table loads successfully (previously returned 403)
4. Run: prove t/db_dependent/api/v1/cashups.t