C4::Auth::get_template_and_user() is an extremely long function. By decomposing it into functions, it becomes easier to test and re-use those functions elsewhere. The current calculation of "CAN_user_*" is also inefficient and contains some unused code, so this would help to clean it up.
Created attachment 139311 [details] [review] Bug 31389: Calculate user permissions in separate function This patch refactors the setting of user permissions for templates into a new function, which can be easily unit tested and reduces the amount of code in C4::Auth::get_template_and_user(). It also aids in the re-usability of permission checking code. Test plan: 0) Apply patch and koha-plack --restart kohadev 1) prove t/Koha/Auth/Permissions.t 2) As koha superlibrarian, go to http://localhost:8081/cgi-bin/koha/tools/tools-home.pl 3) Go to http://localhost:8081/cgi-bin/koha/members/members-home.pl 4) Create new test user with "Staff access..." and "Remaining circulation permissions" 5) Logout of koha superlibrarian 6) Login as test user 7) Note you can only see a limited view of the staff interface (i.e. no administration, no tools, no reports, etc.)
Created attachment 139326 [details] [review] Bug 31389: Calculate user permissions in separate function This patch refactors the setting of user permissions for templates into a new function, which can be easily unit tested and reduces the amount of code in C4::Auth::get_template_and_user(). It also aids in the re-usability of permission checking code. Test plan: 0) Apply patch and koha-plack --restart kohadev 1) prove t/Koha/Auth/Permissions.t 2) As koha superlibrarian, go to http://localhost:8081/cgi-bin/koha/tools/tools-home.pl 3) Go to http://localhost:8081/cgi-bin/koha/members/members-home.pl 4) Create new test user with "Staff access..." and "Remaining circulation permissions" 5) Logout of koha superlibrarian 6) Login as test user 7) Note you can only see a limited view of the staff interface (i.e. no administration, no tools, no reports, etc.)
Created attachment 139398 [details] [review] Bug 31389: Calculate user permissions in separate function This patch refactors the setting of user permissions for templates into a new function, which can be easily unit tested and reduces the amount of code in C4::Auth::get_template_and_user(). It also aids in the re-usability of permission checking code. Test plan: 0) Apply patch and koha-plack --restart kohadev 1) prove t/Koha/Auth/Permissions.t 2) As koha superlibrarian, go to http://localhost:8081/cgi-bin/koha/tools/tools-home.pl 3) Go to http://localhost:8081/cgi-bin/koha/members/members-home.pl 4) Create new test user with "Staff access..." and "Remaining circulation permissions" 5) Logout of koha superlibrarian 6) Login as test user 7) Note you can only see a limited view of the staff interface (i.e. no administration, no tools, no reports, etc.) Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 140202 [details] [review] Bug 31389: Calculate user permissions in separate function This patch refactors the setting of user permissions for templates into a new function, which can be easily unit tested and reduces the amount of code in C4::Auth::get_template_and_user(). It also aids in the re-usability of permission checking code. Test plan: 0) Apply patch and koha-plack --restart kohadev 1) prove t/Koha/Auth/Permissions.t 2) As koha superlibrarian, go to http://localhost:8081/cgi-bin/koha/tools/tools-home.pl 3) Go to http://localhost:8081/cgi-bin/koha/members/members-home.pl 4) Create new test user with "Staff access..." and "Remaining circulation permissions" 5) Logout of koha superlibrarian 6) Login as test user 7) Note you can only see a limited view of the staff interface (i.e. no administration, no tools, no reports, etc.) Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi>
Created attachment 140203 [details] [review] Bug 31389: (QA follow-up) Correct test message The test in question concerns non-superlibrarian staff users. Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi>
Looks good to me but I want one more sign-off from the QA team since this change concerns authorization.
Created attachment 140563 [details] [review] Bug 31389: Calculate user permissions in separate function This patch refactors the setting of user permissions for templates into a new function, which can be easily unit tested and reduces the amount of code in C4::Auth::get_template_and_user(). It also aids in the re-usability of permission checking code. Test plan: 0) Apply patch and koha-plack --restart kohadev 1) prove t/Koha/Auth/Permissions.t 2) As koha superlibrarian, go to http://localhost:8081/cgi-bin/koha/tools/tools-home.pl 3) Go to http://localhost:8081/cgi-bin/koha/members/members-home.pl 4) Create new test user with "Staff access..." and "Remaining circulation permissions" 5) Logout of koha superlibrarian 6) Login as test user 7) Note you can only see a limited view of the staff interface (i.e. no administration, no tools, no reports, etc.) Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Created attachment 140564 [details] [review] Bug 31389: (QA follow-up) Correct test message The test in question concerns non-superlibrarian staff users. Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Second QA run done.. this is a nice little cleanup. Passed.
Created attachment 140844 [details] [review] Bug 31389: (QA follow-up) Missing permissions in tests The following bugs refined permissions a bit, and the change was missing on the tests: * 23681 * 30335 Bonus: sorted permissions alphabetically for readability. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Pushed to master for 22.11. Nice work everyone, thanks!
Enhancement will not be backported to 22.05.x series
In hindsight, there is 1 test missing. For "normal staff user test", I should've included "'reports' => 1" and then checked that it all the sub-permissions authorizations. I've opened bug 32064 to include that missing test.