With a "normal" libarian account (not superlibrarian) it is not possible to see or edit additional fields in erm . The error message "Something went wrong: Error: Authorization failure. Missing required permission(s)." appears. The patron would need the manage_additional_fields permissions, otherwise the API blocks the request. But the manage_additional_fields permissions should not be necessary as it is for administation. To recreate: 1. Log in as superlibrarian 2. Activate ERM 3. Add a new additional field for Licences under cgi-bin/koha/admin/additional-fields.pl 4. Go to ERM Module 5. Add a Licence and use the new additional field 6. Search for a user, for example borrowernumber=17 7. Give permissions for erm , acquisition and catalogue (staff access) 8. Log in with this account 9. Go to ERM Module 10. Try to edit the licence with the additional field you have created in step 5 Check that the error message mentioned above appears
Adding Tomas here to the discussion. In extended_attributes_types, we have: x-koha-authorization: permissions: parameters: manage_additional_fields But staff members editing any of the additional fields supported resources e.g. ERM licenses may not have 'manage_additional_fields'. For Vue additional fields page (such as ERM licenses), this API endpoint needs to be retrieved in order to show configured additional fields on the form. To fix this for posterity, should we just have 'catalogue: "1"' for this endpoint? The UI page to manage additional fields should still be checking for manage_additional_fields anyway.
If we want to be more granular with it we could make it an OR check on the permissions and just add the ERM permission. I think something like the below would work: x-koha-authorization: permissions: - parameters: - manage_additional_fields - erm: 1
That way you should be able to access the ERM pages without needing to be given access to any of the authorised values pages
Created attachment 174758 [details] [review] Bug 38446: Allow those with ERM permissions to access extended attributes Test plan: 1. Log in as superlibrarian 2. Activate ERM 3. Add a new additional field for Licences under cgi-bin/koha/admin/additional-fields.pl 4. Go to ERM Module 5. Add a Licence and use the new additional field 6. Search for a user, for example borrowernumber=17 7. Give permissions for erm , acquisition and catalogue (staff access) 8. Log in with this account 9. Go to ERM Module 10. Try to edit the licence with the additional field you have created in step 5 11. Apply patch and run yarn api:bundle and then restart_all 12. Repeat steps 9 and 10 13. The permissions error should vanish
Patch for discussion based on what I was planning for the vendors migration. If this is too granular then I think we should go with Pedro's suggestion and open up extended attributes more widely