To reproduce: - Enable ERMModule - Login as a staff member that only has 2 permissions: -- catalogue (required for staff login) -- erm - Access erm page, check the 403 forbidden error This happens because ERM module is requesting the /api/v1/acquisitions/vendors api endpoint which in turn requires the vendors_manage sub-permission (see acquisitions_vendors.yaml). If you enable the acquisition vendors_manage sub-permission for that user, you're able to confirm that you can now access the ERM module as expected. Ideally, having just the 'erm' permission should be enough to be granted access to ERM.
To add to this list, and likely to update the title of this bug sometime in the future: In order to add a user to an agreement (and license), the permission edit_borrowers is required, or a 403 is returned. Ideally, having just the 'erm' permission should be enough to be granted correct access to all of ERM.
(In reply to Pedro Amorim from comment #1) > In order to add a user to an agreement (and license), the permission > edit_borrowers is required, or a 403 is returned. Confirmed "GET /api/v1/app.pl/api/v1/patrons/5 HTTP/1.1" 403 - "http://kohadev-intra.mydnsname.org:8081/cgi-bin/koha/erm/licenses/add" "Mozilla/5.0 (X11; Linux x86_64)
(In reply to Jonathan Druart from comment #2) > (In reply to Pedro Amorim from comment #1) > > In order to add a user to an agreement (and license), the permission > > edit_borrowers is required, or a 403 is returned. > > Confirmed > > "GET /api/v1/app.pl/api/v1/patrons/5 HTTP/1.1" 403 - > "http://kohadev-intra.mydnsname.org:8081/cgi-bin/koha/erm/licenses/add" > "Mozilla/5.0 (X11; Linux x86_64) So basically we need a new endpoint /erm/users/:patron_id, or tweak includes/patron-search.inc to inject all patron's info on the opener's DOM instead of just the id (search for "selected_patron_id").
Is this resolved with 33606?
(In reply to Catrina Berka from comment #4) > Is this resolved with 33606? It's not. These are different issues. Bug 33606 updated the way we fetch the system preferences related to ERM. The reproduce instructions in this current bug 32971 still apply, i.e. the issue is still there. The issue is caused by the ERM module fetching vendors through the /api/v1/acquisitions/vendors endpoint. But that endpoint requires the acquisitions permission, specifically the vendors_manage sub-permission.
Just ran into this testing 33606. In the serials module you can still use existing vendors and link them to subscriptions without having vendor_manage. I think the same behaviour would make sense for the ERM module as well.