Bug 38930 - Add a permissions store for Vue apps
Summary: Add a permissions store for Vue apps
Status: In Discussion
Alias: None
Product: Koha
Classification: Unclassified
Component: ERM (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Matt Blenkinsop
QA Contact: Testopia
URL:
Keywords:
Depends on: 37930
Blocks: 38941
  Show dependency treegraph
 
Reported: 2025-01-20 15:15 UTC by Matt Blenkinsop
Modified: 2025-01-21 16:45 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 38930: Add API endpoint (6.04 KB, patch)
2025-01-20 15:42 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 38930: Add a permissions store (2.75 KB, patch)
2025-01-20 15:42 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 38930: (DO NOT PUSH) Add an example to ERM (4.19 KB, patch)
2025-01-20 15:42 UTC, Matt Blenkinsop
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Matt Blenkinsop 2025-01-20 15:15:30 UTC
We need to be able to handle permissions within Vue apps to do things like hiding action buttons or menu options
Comment 1 Matt Blenkinsop 2025-01-20 15:42:50 UTC
Created attachment 176826 [details] [review]
Bug 38930: Add API endpoint

This patch adds an API endpoint to return a hash of a user's permissions
Comment 2 Matt Blenkinsop 2025-01-20 15:42:52 UTC
Created attachment 176827 [details] [review]
Bug 38930: Add a permissions store

This patch adds a permissions store to hold a user's permissions and run checks when required

Test plan:
1) Apply the patch and run the following commands
a) yarn build
b) restart_all
2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements
3) Note that the button for New Agreement is visible
4) Choose a random staff user and assign them the following permissions:
- Staff access, allows viewing of the catalogue in staff interface (catalogue)
- Manage Koha system settings (Administration panel) (parameters)
- Acquisition management (acquisition)
- Manage the electronic resources module (erm)
These are the permissions required to access the ERM module
6) Open an incognito browser and log in as the chosen staff member with these permissions
7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work
8) Navigate to the Agreements page again, the button should not be visible
9) Back in your main browser, assign the following permission set to the user:
- Create purchase suggestions (suggestions_create)
10) Hard refresh the incognito browser, the button should now be visible again
Comment 3 Matt Blenkinsop 2025-01-20 15:42:55 UTC
Created attachment 176828 [details] [review]
Bug 38930: (DO NOT PUSH) Add an example to ERM
Comment 4 David Cook 2025-01-20 23:29:43 UTC
I found the title a bit scary at first, but the patches make sense. No point showing options that users aren't authorized to do.
Comment 5 Jonathan Druart 2025-01-21 08:28:26 UTC
This looks good.

Some remarks however:
1. Missing tests (at least for the new REST API endpoint, but it would be good to have some Cypress tests)
2. (wording) Wondering if "isUserPermitted" should not be closed to what we have in the module: has_permissions. What do you think?
3. 
About the endpoint, you named it /user_permissions

There is a comment in the code:
Koha/Patron.pm:        flags               => undef,    # permissions manipulation handled in /permissions

And in Koha/REST/V1/ERM.pm:
40 sub config {
49             # TODO Add permissions

There are contradicting one another, but we discussed that when we implemented /erm/config and we agreed to have the logged in user's info embedded in this route.

I think we should discuss 3. with Tomas.