Bug 32682 - Add permission for viewing patron reading history
Summary: Add permission for viewing patron reading history
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: David Flater
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 40364
  Show dependency treegraph
 
Reported: 2023-01-19 18:21 UTC by Donna
Modified: 2025-07-14 15:56 UTC (History)
9 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 32682: Add permission for viewing patron reading history (2.81 KB, patch)
2025-07-07 15:46 UTC, David Flater
Details | Diff | Splinter Review
Bug 32682: Implement reading history permission (5.28 KB, patch)
2025-07-07 15:46 UTC, David Flater
Details | Diff | Splinter Review
Bug 32682: Adjust atomicupdate permission (605 bytes, patch)
2025-07-07 15:46 UTC, David Flater
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Donna 2023-01-19 18:21:33 UTC
With intranetreadinghistory it is an all or nothing option - there are often situations where staff will need to view this, but not necessarily every staff member needs to see the information.  It would be great to add the ability to view this to the permissions so libraries can decided which staff have this ability.
Comment 1 trevor.diamond 2025-04-07 19:25:27 UTC
Hear here!  Great idea and as a consortium we are wholeheartedly behind this kind of development.
Comment 2 David Flater 2025-07-07 15:46:07 UTC
Created attachment 183844 [details] [review]
Bug 32682: Add permission for viewing patron reading history
Comment 3 David Flater 2025-07-07 15:46:09 UTC
Created attachment 183845 [details] [review]
Bug 32682: Implement reading history permission
Comment 4 David Flater 2025-07-07 15:46:12 UTC
Created attachment 183846 [details] [review]
Bug 32682: Adjust atomicupdate permission
Comment 5 Owen Leonard 2025-07-07 16:57:14 UTC
Is this ready for testing?
Comment 6 David Flater 2025-07-08 21:32:30 UTC
It's not quite ready yet--I'm still working on both a test plan and migrating over old functionality so that libraries don't experience a change in expected functionality.
Comment 7 David Cook 2025-07-09 00:20:23 UTC
Comment on attachment 183844 [details] [review]
Bug 32682: Add permission for viewing patron reading history

Review of attachment 183844 [details] [review]:
-----------------------------------------------------------------

::: installer/data/mysql/atomicupdate/bug_32682_add_permission.pl
@@ +24,5 @@
> +        #     SELECT borrowernumber, 10, 'view_checkout_history' FROM user_permissions WHERE code = 'remaining_permissions'
> +        # }
> +        # );
> +
> +        # TODO: migrate libraries' "intranetreadinghistory" syspref (will this require us to not fully remove it until we're sure everyone has migrated off of it?)

This is an interesting question. Technically, I think that you have to keep the intranetreadinghistory because it's impossible to replace it with permissions only. For instance, maybe you disable intranetreadinghistory via Apache configuration because you don't want anyone - even superlibrarians to be able to read the checkout history.

If you have libraries with intranetreadinghistory turned off, then these patches will actually cause a regression where anyone with all borrowers permissions will be able to see the reading history when they couldn't previously.
Comment 8 David Cook 2025-07-09 00:22:35 UTC
Failing due to my above comment.

On the plus side, with a small adjustment, I think that these patches would be nearly good to go. 

I suppose the only scenario not covered would be where intranetreadinghistory is enabled and you have limited borrower permissions and you used to be able to read the checkout history and now you can't...

I suppose you could add another SQL update that adds the view_checkout_history permission if they had permission to view the pages that this is modifying...