Bug 38914 - REST API account endpoint permissions should not require edit_borrowers permission
Summary: REST API account endpoint permissions should not require edit_borrowers permi...
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-01-16 21:25 UTC by Nick Clemens (kidclamp)
Modified: 2025-01-16 21:25 UTC (History)
2 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens (kidclamp) 2025-01-16 21:25:17 UTC
The patrons endpoint now requires only 'list_borrowers' for GET requests

The patrons/account endpoint requires "edit_borrowers" and "updatecharges:remaining_permissions" which is really view only

The edit_borrowers in the second should be "list_borrowers" so that outside systems can view charges without needing to be able to edit patrons.