Bug 35574 - Bookings page should require only manage_bookings permissions
Summary: Bookings page should require only manage_bookings permissions
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Nick Clemens
QA Contact: Testopia
URL:
Keywords:
Depends on: 29002
Blocks:
  Show dependency treegraph
 
Reported: 2023-12-14 17:09 UTC by Nick Clemens
Modified: 2024-01-15 15:15 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.02


Attachments
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission (1.24 KB, patch)
2023-12-14 17:13 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission (1.30 KB, patch)
2023-12-14 17:17 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 35574: Correct api permission for listing biblio specific bookings (968 bytes, patch)
2023-12-14 17:44 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission (1.30 KB, patch)
2023-12-15 11:06 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 35574:Correct api permission for listing biblio specific bookings (1.01 KB, patch)
2023-12-15 11:06 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 35574: Add unit tests for api change (3.51 KB, patch)
2023-12-15 11:06 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission (1.30 KB, patch)
2023-12-15 11:07 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 35574: Correct api permission for listing biblio specific bookings (1.01 KB, patch)
2023-12-15 11:07 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 35574: Add unit tests for api change (3.51 KB, patch)
2023-12-15 11:07 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 35574: Don't show the link either (1.16 KB, patch)
2023-12-15 11:12 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission (1.36 KB, patch)
2023-12-15 12:35 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 35574: Correct api permission for listing biblio specific bookings (1.06 KB, patch)
2023-12-15 12:35 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 35574: Add unit tests for api change (3.57 KB, patch)
2023-12-15 12:35 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 35574: Don't show the link either (1.21 KB, patch)
2023-12-15 12:35 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 35574: Tidy (1.91 KB, patch)
2023-12-15 12:35 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission (1.41 KB, patch)
2023-12-15 19:27 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 35574: Correct api permission for listing biblio specific bookings (1.12 KB, patch)
2023-12-15 19:27 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 35574: Add unit tests for api change (3.62 KB, patch)
2023-12-15 19:27 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 35574: Don't show the link either (1.27 KB, patch)
2023-12-15 19:27 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 35574: Tidy (1.96 KB, patch)
2023-12-15 19:27 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens 2023-12-14 17:09:05 UTC
Currently it requires 'circulate => 1'
I believe it should be 'circulate => "manage_bookings"'
Comment 1 Nick Clemens 2023-12-14 17:13:47 UTC
Created attachment 159851 [details] [review]
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission

TO test:
1 - Find or create a staff user
2 - Grant permissions:
    circulate: manage_bookings, circ_remaining_permissions
    catalogue
3 - Open a record details, go to items tab, mark an item as bookable
4 - Sign out and sign in as the patron above (or use a private window to sign in)
5 - Place a booking on the record located above
6 - Success
7 - Try to view the bookings tab
8 - Fail, you don't have permission
9 - Apply patch
10 - Success!
Comment 2 Martin Renvoize 2023-12-14 17:17:48 UTC
Created attachment 159852 [details] [review]
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission

TO test:
1 - Find or create a staff user
2 - Grant permissions:
    circulate: manage_bookings, circ_remaining_permissions
    catalogue
3 - Open a record details, go to items tab, mark an item as bookable
4 - Sign out and sign in as the patron above (or use a private window to sign in)
5 - Place a booking on the record located above
6 - Success
7 - Try to view the bookings tab
8 - Fail, you don't have permission
9 - Apply patch
10 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 3 Nick Clemens 2023-12-14 17:44:46 UTC
Created attachment 159853 [details] [review]
Bug 35574:  Correct api permission for listing biblio specific bookings

To test:
1 - Follow above plan and apply only first patch
2 - Not the table does not load (403: Forbidden)
3 - Apply this patch
4 - Reload
5 - Success!
Comment 4 Martin Renvoize 2023-12-15 11:06:41 UTC
Created attachment 159874 [details] [review]
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission

TO test:
1 - Find or create a staff user
2 - Grant permissions:
    circulate: manage_bookings, circ_remaining_permissions
    catalogue
3 - Open a record details, go to items tab, mark an item as bookable
4 - Sign out and sign in as the patron above (or use a private window to sign in)
5 - Place a booking on the record located above
6 - Success
7 - Try to view the bookings tab
8 - Fail, you don't have permission
9 - Apply patch
10 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Martin Renvoize 2023-12-15 11:06:43 UTC
Created attachment 159875 [details] [review]
Bug 35574:Correct api permission for listing biblio specific bookings

To test:
1 - Follow above plan and apply only first patch
2 - Not the table does not load (403: Forbidden)
3 - Apply this patch
4 - Reload
5 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 6 Martin Renvoize 2023-12-15 11:06:46 UTC
Created attachment 159876 [details] [review]
Bug 35574: Add unit tests for api change

We add the corresponding unit tests for the biblio/bookings endpoint to
ensure no regressions in the future.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 7 Martin Renvoize 2023-12-15 11:07:53 UTC
Created attachment 159877 [details] [review]
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission

TO test:
1 - Find or create a staff user
2 - Grant permissions:
    circulate: manage_bookings, circ_remaining_permissions
    catalogue
3 - Open a record details, go to items tab, mark an item as bookable
4 - Sign out and sign in as the patron above (or use a private window to sign in)
5 - Place a booking on the record located above
6 - Success
7 - Try to view the bookings tab
8 - Fail, you don't have permission
9 - Apply patch
10 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 8 Martin Renvoize 2023-12-15 11:07:55 UTC
Created attachment 159878 [details] [review]
Bug 35574: Correct api permission for listing biblio specific bookings

To test:
1 - Follow above plan and apply only first patch
2 - Not the table does not load (403: Forbidden)
3 - Apply this patch
4 - Reload
5 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 9 Martin Renvoize 2023-12-15 11:07:58 UTC
Created attachment 159879 [details] [review]
Bug 35574: Add unit tests for api change

We add the corresponding unit tests for the biblio/bookings endpoint to
ensure no regressions in the future.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 10 Martin Renvoize 2023-12-15 11:12:47 UTC
Created attachment 159880 [details] [review]
Bug 35574: Don't show the link either

This patch adds the check for permission to the biblio menu item too.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 11 Nick Clemens 2023-12-15 12:35:38 UTC
Created attachment 159886 [details] [review]
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission

TO test:
1 - Find or create a staff user
2 - Grant permissions:
    circulate: manage_bookings, circ_remaining_permissions
    catalogue
3 - Open a record details, go to items tab, mark an item as bookable
4 - Sign out and sign in as the patron above (or use a private window to sign in)
5 - Place a booking on the record located above
6 - Success
7 - Try to view the bookings tab
8 - Fail, you don't have permission
9 - Apply patch
10 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>


Current status: Signed Off
Comment 12 Nick Clemens 2023-12-15 12:35:41 UTC
Created attachment 159887 [details] [review]
Bug 35574: Correct api permission for listing biblio specific bookings

To test:
1 - Follow above plan and apply only first patch
2 - Not the table does not load (403: Forbidden)
3 - Apply this patch
4 - Reload
5 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 13 Nick Clemens 2023-12-15 12:35:43 UTC
Created attachment 159888 [details] [review]
Bug 35574: Add unit tests for api change

We add the corresponding unit tests for the biblio/bookings endpoint to
ensure no regressions in the future.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 14 Nick Clemens 2023-12-15 12:35:45 UTC
Created attachment 159889 [details] [review]
Bug 35574: Don't show the link either

This patch adds the check for permission to the biblio menu item too.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 15 Nick Clemens 2023-12-15 12:35:47 UTC
Created attachment 159890 [details] [review]
Bug 35574: Tidy

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 16 Tomás Cohen Arazi 2023-12-15 19:27:09 UTC
Created attachment 159896 [details] [review]
Bug 35574: Bookings tab from biblio details should only require manage_bookings permission

TO test:
1 - Find or create a staff user
2 - Grant permissions:
    circulate: manage_bookings, circ_remaining_permissions
    catalogue
3 - Open a record details, go to items tab, mark an item as bookable
4 - Sign out and sign in as the patron above (or use a private window to sign in)
5 - Place a booking on the record located above
6 - Success
7 - Try to view the bookings tab
8 - Fail, you don't have permission
9 - Apply patch
10 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 17 Tomás Cohen Arazi 2023-12-15 19:27:16 UTC
Created attachment 159897 [details] [review]
Bug 35574: Correct api permission for listing biblio specific bookings

To test:
1 - Follow above plan and apply only first patch
2 - Not the table does not load (403: Forbidden)
3 - Apply this patch
4 - Reload
5 - Success!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 18 Tomás Cohen Arazi 2023-12-15 19:27:27 UTC
Created attachment 159898 [details] [review]
Bug 35574: Add unit tests for api change

We add the corresponding unit tests for the biblio/bookings endpoint to
ensure no regressions in the future.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 19 Tomás Cohen Arazi 2023-12-15 19:27:40 UTC
Created attachment 159899 [details] [review]
Bug 35574: Don't show the link either

This patch adds the check for permission to the biblio menu item too.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 20 Tomás Cohen Arazi 2023-12-15 19:27:55 UTC
Created attachment 159900 [details] [review]
Bug 35574: Tidy

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 21 Tomás Cohen Arazi 2023-12-15 19:28:47 UTC
Trivial fix. QA script happy. Lots of missing tests added. Yay!
Comment 22 Katrin Fischer 2023-12-18 14:25:53 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 23 Fridolin Somers 2024-01-03 14:48:59 UTC
Pushed to 23.11.x for 23.11.02
Comment 24 Lucas Gass 2024-01-04 20:21:10 UTC
Missing dependencies for 23.05.x, no backport.