Bug 30623 - Copy permissions from one user to another
Summary: Copy permissions from one user to another
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement with 35 votes (vote)
Assignee: Owen Leonard
QA Contact: Marcel de Rooy
URL:
Keywords: additional_work_needed
Depends on:
Blocks:
 
Reported: 2022-04-26 18:27 UTC by Owen Leonard
Modified: 2024-04-29 07:37 UTC (History)
21 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00


Attachments
Bug 30623: Copy permissions from one user to another (7.50 KB, patch)
2023-07-13 17:51 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 30623: Copy permissions from one user to another (7.55 KB, patch)
2023-07-13 19:24 UTC, Michal Denar
Details | Diff | Splinter Review
Bug 30623: Copy permissions from one user to another (7.55 KB, patch)
2023-09-01 17:45 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 30623: Copy permissions from one user to another (7.56 KB, patch)
2023-12-04 17:26 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 30623: Copy permissions from one user to another (7.61 KB, patch)
2024-01-31 16:47 UTC, Lucas Gass
Details | Diff | Splinter Review
Bug 30623: Copy permissions from one user to another (7.67 KB, patch)
2024-04-18 14:03 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2022-04-26 18:27:11 UTC
I would like to add a way to "copy" a user's permissions and "paste" them into another patron record. I can do this by reading the form state into localStorage and then parsing that to update the form state when editing another user's permissions.
Comment 1 Michal Denar 2022-04-28 09:59:28 UTC
+1
Comment 2 Andrew Fuerste-Henry 2022-09-08 17:06:56 UTC
+1, this would be great.
Comment 3 vstever 2023-03-30 21:16:49 UTC
+5 votes. In smaller libraries, a staff member has overlapping roles so we see quite a few customized permissions among the 6 member libraries in our Cooperative. When staff turnover occurs in those customized positions, this would be SO helpful.
Comment 4 Owen Leonard 2023-07-13 17:51:30 UTC Comment hidden (obsolete)
Comment 5 Owen Leonard 2023-07-13 17:57:05 UTC
This is not as full-featured as Christopher Brannon's "Add clear and preset permission buttons, and a copy button to user permissions page" customization on the wiki, https://wiki.koha-community.org/wiki/JQuery_Library#Add_clear_and_preset_permission_buttons.2C_and_a_copy_button_to_user_permissions_page_.28v20.x.29, but I think it's a good first step for something that is generalized and simple.
Comment 6 Michal Denar 2023-07-13 19:24:00 UTC Comment hidden (obsolete)
Comment 7 Marcel de Rooy 2023-07-14 06:37:16 UTC
Moving this to In Discussion temporarily. Will mail QA about it.
I am not very sure if we should do this via js and localStorage at the client side in terms of security.
Comment 8 Tomás Cohen Arazi 2023-07-14 12:07:02 UTC
Can we think of a way to define permissions profiles, and assign permission profiles instead?
Comment 9 Owen Leonard 2023-07-14 13:36:54 UTC
I wouldn't think there was a security issue since I'm just saving the form state.  The options in the form are available to anyone with permission to set permission.

Folks have been wanting something like permission profiles for years, so I assume we'd have to find funding to make that happen.
Comment 10 Marcel de Rooy 2023-07-14 14:48:08 UTC
(In reply to Owen Leonard from comment #9)
> I wouldn't think there was a security issue since I'm just saving the form
> state.  The options in the form are available to anyone with permission to
> set permission.

And the form state is in localStorage and cannot be mangled ;)
Comment 11 Owen Leonard 2023-07-14 14:54:10 UTC
(In reply to Marcel de Rooy from comment #10)
> And the form state is in localStorage and cannot be mangled ;)

I don't understand what you're trying to say here.
Comment 12 David Cook 2023-07-17 00:29:17 UTC
I'm not sure I'm a fan in terms of the UX but I don't see an issue from the security side. 

At a glance, it seems to only be copying the permission flags, so there is no data tying the permission flags to a particular user. 

The actual update is done server-side anyway, so it wouldn't be bypassing any authorization/validation steps.
Comment 13 Evaldo Santos 2023-08-30 13:52:42 UTC
(In reply to Tomás Cohen Arazi from comment #8)
> Can we think of a way to define permissions profiles, and assign permission
> profiles instead?

100% on it.

That in fact is the solution. And with the possibility to import and export.
- Pemission profile that can be assigned to a category of patron
- Permission profile that can be assigne to a patron
Comment 14 Owen Leonard 2023-09-01 17:45:03 UTC Comment hidden (obsolete)
Comment 15 Owen Leonard 2023-12-04 17:26:12 UTC
Created attachment 159552 [details] [review]
Bug 30623: Copy permissions from one user to another

This patch adds controls to the patron "Set permissions" page allowing
the user to copy a set of permissions from one patron to another.

The patch also makes a minor correction to global staff interface CSS to
correct the appearance of non-primary split buttons.

To test, apply the patch and rebuild the staff interface CSS. You may
want to clear your browser cache.

- Locate a patron in the staff client and choose More -> Set
  permissions. You might want to start with a staff patron who has
  multiple permissions enabled.
- You should see two new buttons in the toolbar immediately above the
  list of permissions: "Copy settings," a split button with a secondary
  option to choose "Forget copied settings"; and "Paste settings" which
  should be disabled by default.
- Clicking the "Copy settings" button should trigger the copy icon to
  cycle/fade from the copy icon to the check-mark icon and back to the
  copy icon. I thought this interaction needed some visual feedback
  since it doesn't otherwise trigger visible action.
- Clicking the "Copy settings" button should also enable the "Paste
  settings" button.
- Locate another patron, preferable one with permissions visibly
  different from your first choice.
- On their "Set permissions" page, click the "Paste settings" button.
  The list of permissions should expand all settings and all the
  checkboxes should now match your original choice.
- At this stage you could find another patron and paste the same
  permissions again.
- Click "Copy settings -> Forget copied settings." The "Paste settings"
  button should become disabled.
- Using the browser console to check the contents of Local Storage
  should confirm that the "copiedPermissions" entry has been removed.
Comment 16 Owen Leonard 2024-01-08 14:26:48 UTC
(In reply to Marcel de Rooy from comment #7)
> Moving this to In Discussion temporarily. Will mail QA about it.

I'm curious whether there has been a QA team discussion about this?
Comment 17 Marcel de Rooy 2024-01-10 13:08:14 UTC
(In reply to Owen Leonard from comment #16)
> (In reply to Marcel de Rooy from comment #7)
> > Moving this to In Discussion temporarily. Will mail QA about it.
> 
> I'm curious whether there has been a QA team discussion about this?

Owen, unfortunately I am not aware of any specific feedback that should have been noted here apart from the comment of Tomas.
Comment 18 Katrin Fischer 2024-01-22 21:53:13 UTC
I agree that permission profiles are the ultimate solution we should have, but this seems like it's available "now" and would be really helpful. I know my coworkers would love it as we do a lot of staff user setup in terms of "same permissions as user x".

If we haven't been able to identify a security concern until now, I don't think this should be stuck in "In Discussion".

The only comment I have is that I'd relabel "settings" to "permissions": Copy settings -> Copy permissions etc. Settings is a very general term, specific is always good for translations and such :)
Comment 19 David Cook 2024-01-22 22:30:15 UTC
(In reply to Katrin Fischer from comment #18)
> I agree that permission profiles are the ultimate solution we should have,
> but this seems like it's available "now" and would be really helpful. I know
> my coworkers would love it as we do a lot of staff user setup in terms of
> "same permissions as user x".

+1
Comment 20 Katrin Fischer 2024-01-28 13:26:31 UTC
Sending this back into testing.
Comment 21 Lucas Gass 2024-01-31 16:47:23 UTC
Created attachment 161700 [details] [review]
Bug 30623: Copy permissions from one user to another

This patch adds controls to the patron "Set permissions" page allowing
the user to copy a set of permissions from one patron to another.

The patch also makes a minor correction to global staff interface CSS to
correct the appearance of non-primary split buttons.

To test, apply the patch and rebuild the staff interface CSS. You may
want to clear your browser cache.

- Locate a patron in the staff client and choose More -> Set
  permissions. You might want to start with a staff patron who has
  multiple permissions enabled.
- You should see two new buttons in the toolbar immediately above the
  list of permissions: "Copy settings," a split button with a secondary
  option to choose "Forget copied settings"; and "Paste settings" which
  should be disabled by default.
- Clicking the "Copy settings" button should trigger the copy icon to
  cycle/fade from the copy icon to the check-mark icon and back to the
  copy icon. I thought this interaction needed some visual feedback
  since it doesn't otherwise trigger visible action.
- Clicking the "Copy settings" button should also enable the "Paste
  settings" button.
- Locate another patron, preferable one with permissions visibly
  different from your first choice.
- On their "Set permissions" page, click the "Paste settings" button.
  The list of permissions should expand all settings and all the
  checkboxes should now match your original choice.
- At this stage you could find another patron and paste the same
  permissions again.
- Click "Copy settings -> Forget copied settings." The "Paste settings"
  button should become disabled.
- Using the browser console to check the contents of Local Storage
  should confirm that the "copiedPermissions" entry has been removed.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 22 Marcel de Rooy 2024-04-18 13:37:43 UTC
Looking here
Comment 23 Marcel de Rooy 2024-04-18 14:03:43 UTC
Created attachment 165108 [details] [review]
Bug 30623: Copy permissions from one user to another

This patch adds controls to the patron "Set permissions" page allowing
the user to copy a set of permissions from one patron to another.

The patch also makes a minor correction to global staff interface CSS to
correct the appearance of non-primary split buttons.

To test, apply the patch and rebuild the staff interface CSS. You may
want to clear your browser cache.

- Locate a patron in the staff client and choose More -> Set
  permissions. You might want to start with a staff patron who has
  multiple permissions enabled.
- You should see two new buttons in the toolbar immediately above the
  list of permissions: "Copy settings," a split button with a secondary
  option to choose "Forget copied settings"; and "Paste settings" which
  should be disabled by default.
- Clicking the "Copy settings" button should trigger the copy icon to
  cycle/fade from the copy icon to the check-mark icon and back to the
  copy icon. I thought this interaction needed some visual feedback
  since it doesn't otherwise trigger visible action.
- Clicking the "Copy settings" button should also enable the "Paste
  settings" button.
- Locate another patron, preferable one with permissions visibly
  different from your first choice.
- On their "Set permissions" page, click the "Paste settings" button.
  The list of permissions should expand all settings and all the
  checkboxes should now match your original choice.
- At this stage you could find another patron and paste the same
  permissions again.
- Click "Copy settings -> Forget copied settings." The "Paste settings"
  button should become disabled.
- Using the browser console to check the contents of Local Storage
  should confirm that the "copiedPermissions" entry has been removed.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 24 Katrin Fischer 2024-04-29 07:17:34 UTC
> The only comment I have is that I'd relabel "settings" to "permissions":
> Copy settings -> Copy permissions etc. Settings is a very general term,
> specific is always good for translations and such :)

I left 'settings' for now, but still feel permissions might be nicer. Any opinions? :)

(using additional_work_needed to highlight the question :) )
Comment 25 Katrin Fischer 2024-04-29 07:37:54 UTC
Pushed for 24.05!

Well done everyone, thank you!