Bug 38930 - Add a permissions store for Vue apps
Summary: Add a permissions store for Vue apps
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Matt Blenkinsop
QA Contact: Jonathan Druart
URL:
Keywords: release-notes-needed
Depends on: 37930
Blocks: 38941
  Show dependency treegraph
 
Reported: 2025-01-20 15:15 UTC by Matt Blenkinsop
Modified: 2025-05-26 14:05 UTC (History)
9 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.05.00
Circulation function:


Attachments
Bug 38930: Add API endpoint (6.04 KB, patch)
2025-01-20 15:42 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 38930: Add a permissions store (2.75 KB, patch)
2025-01-20 15:42 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 38930: (DO NOT PUSH) Add an example to ERM (4.19 KB, patch)
2025-01-20 15:42 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 38930: Add API endpoint (6.02 KB, patch)
2025-02-18 14:04 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 38930: Add a permissions store (2.75 KB, patch)
2025-02-18 14:04 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 38930: (DO NOT PUSH) Add an example to ERM (4.21 KB, patch)
2025-02-18 14:04 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 38930: Add a permissions store (2.49 KB, patch)
2025-04-23 11:28 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 38930: (DO NOT PUSH) Add an example to ERM (5.62 KB, patch)
2025-04-23 11:28 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 38930: (DO NOT PUSH) Add an example to ERM (5.62 KB, patch)
2025-04-28 12:52 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 38930: (DO NOT PUSH) Add an example to ERM (5.66 KB, patch)
2025-04-28 15:04 UTC, Biblibre Sandboxes
Details | Diff | Splinter Review
Bug 38930: Add a permissions store (2.54 KB, patch)
2025-04-28 15:06 UTC, Biblibre Sandboxes
Details | Diff | Splinter Review
Bug 38930: (DO NOT PUSH) Add an example to ERM (5.66 KB, patch)
2025-04-28 15:06 UTC, Biblibre Sandboxes
Details | Diff | Splinter Review
Bug 38930: Add a permissions store (2.49 KB, patch)
2025-04-30 19:58 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 38930: Add a permissions store (2.62 KB, patch)
2025-04-30 20:54 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Matt Blenkinsop 2025-01-20 15:15:30 UTC
We need to be able to handle permissions within Vue apps to do things like hiding action buttons or menu options
Comment 1 Matt Blenkinsop 2025-01-20 15:42:50 UTC
Created attachment 176826 [details] [review]
Bug 38930: Add API endpoint

This patch adds an API endpoint to return a hash of a user's permissions
Comment 2 Matt Blenkinsop 2025-01-20 15:42:52 UTC
Created attachment 176827 [details] [review]
Bug 38930: Add a permissions store

This patch adds a permissions store to hold a user's permissions and run checks when required

Test plan:
1) Apply the patch and run the following commands
a) yarn build
b) restart_all
2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements
3) Note that the button for New Agreement is visible
4) Choose a random staff user and assign them the following permissions:
- Staff access, allows viewing of the catalogue in staff interface (catalogue)
- Manage Koha system settings (Administration panel) (parameters)
- Acquisition management (acquisition)
- Manage the electronic resources module (erm)
These are the permissions required to access the ERM module
6) Open an incognito browser and log in as the chosen staff member with these permissions
7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work
8) Navigate to the Agreements page again, the button should not be visible
9) Back in your main browser, assign the following permission set to the user:
- Create purchase suggestions (suggestions_create)
10) Hard refresh the incognito browser, the button should now be visible again
Comment 3 Matt Blenkinsop 2025-01-20 15:42:55 UTC
Created attachment 176828 [details] [review]
Bug 38930: (DO NOT PUSH) Add an example to ERM
Comment 4 David Cook 2025-01-20 23:29:43 UTC
I found the title a bit scary at first, but the patches make sense. No point showing options that users aren't authorized to do.
Comment 5 Jonathan Druart 2025-01-21 08:28:26 UTC
This looks good.

Some remarks however:
1. Missing tests (at least for the new REST API endpoint, but it would be good to have some Cypress tests)
2. (wording) Wondering if "isUserPermitted" should not be closed to what we have in the module: has_permissions. What do you think?
3. 
About the endpoint, you named it /user_permissions

There is a comment in the code:
Koha/Patron.pm:        flags               => undef,    # permissions manipulation handled in /permissions

And in Koha/REST/V1/ERM.pm:
40 sub config {
49             # TODO Add permissions

There are contradicting one another, but we discussed that when we implemented /erm/config and we agreed to have the logged in user's info embedded in this route.

I think we should discuss 3. with Tomas.
Comment 6 Matt Blenkinsop 2025-02-18 14:04:31 UTC
Created attachment 178245 [details] [review]
Bug 38930: Add API endpoint

This patch adds an API endpoint to return a hash of a user's permissions
Comment 7 Matt Blenkinsop 2025-02-18 14:04:33 UTC
Created attachment 178246 [details] [review]
Bug 38930: Add a permissions store

This patch adds a permissions store to hold a user's permissions and run checks when required

Test plan:
1) Apply the patch and run the following commands
a) yarn build
b) restart_all
2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements
3) Note that the button for New Agreement is visible
4) Choose a random staff user and assign them the following permissions:
- Staff access, allows viewing of the catalogue in staff interface (catalogue)
- Manage Koha system settings (Administration panel) (parameters)
- Acquisition management (acquisition)
- Manage the electronic resources module (erm)
These are the permissions required to access the ERM module
6) Open an incognito browser and log in as the chosen staff member with these permissions
7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work
8) Navigate to the Agreements page again, the button should not be visible
9) Back in your main browser, assign the following permission set to the user:
- Create purchase suggestions (suggestions_create)
10) Hard refresh the incognito browser, the button should now be visible again
Comment 8 Matt Blenkinsop 2025-02-18 14:04:36 UTC
Created attachment 178247 [details] [review]
Bug 38930: (DO NOT PUSH) Add an example to ERM
Comment 9 Matt Blenkinsop 2025-04-23 11:28:09 UTC
Created attachment 181365 [details] [review]
Bug 38930: Add a permissions store

This patch adds a permissions store to hold a user's permissions and run checks when required

Test plan:
1) Apply the patch and run the following commands
a) yarn build
b) restart_all
2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements
3) Note that the button for New Agreement is visible
4) Choose a random staff user and assign them the following permissions:
- Staff access, allows viewing of the catalogue in staff interface (catalogue)
- Manage Koha system settings (Administration panel) (parameters)
- Acquisition management (acquisition)
- Manage the electronic resources module (erm)
These are the permissions required to access the ERM module
6) Open an incognito browser and log in as the chosen staff member with these permissions
7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work
8) Navigate to the Agreements page again, the button should not be visible
9) Back in your main browser, assign the following permission set to the user:
- Create purchase suggestions (suggestions_create)
10) Hard refresh the incognito browser, the button should now be visible again
Comment 10 Matt Blenkinsop 2025-04-23 11:28:12 UTC
Created attachment 181366 [details] [review]
Bug 38930: (DO NOT PUSH) Add an example to ERM
Comment 11 Matt Blenkinsop 2025-04-28 12:52:58 UTC
Created attachment 181609 [details] [review]
Bug 38930: (DO NOT PUSH) Add an example to ERM
Comment 12 Biblibre Sandboxes 2025-04-28 15:04:45 UTC
Created attachment 181622 [details] [review]
Bug 38930: (DO NOT PUSH) Add an example to ERM

Signed-off-by: Michaela <michaela.sieber@kit.edu>
Comment 13 Biblibre Sandboxes 2025-04-28 15:06:25 UTC
Created attachment 181624 [details] [review]
Bug 38930: Add a permissions store

This patch adds a permissions store to hold a user's permissions and run checks when required

Test plan:
1) Apply the patch and run the following commands
a) yarn build
b) restart_all
2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements
3) Note that the button for New Agreement is visible
4) Choose a random staff user and assign them the following permissions:
- Staff access, allows viewing of the catalogue in staff interface (catalogue)
- Manage Koha system settings (Administration panel) (parameters)
- Acquisition management (acquisition)
- Manage the electronic resources module (erm)
These are the permissions required to access the ERM module
6) Open an incognito browser and log in as the chosen staff member with these permissions
7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work
8) Navigate to the Agreements page again, the button should not be visible
9) Back in your main browser, assign the following permission set to the user:
- Create purchase suggestions (suggestions_create)
10) Hard refresh the incognito browser, the button should now be visible again

Signed-off-by: Michaela <michaela.sieber@kit.edu>
Comment 14 Biblibre Sandboxes 2025-04-28 15:06:28 UTC
Created attachment 181625 [details] [review]
Bug 38930: (DO NOT PUSH) Add an example to ERM

Signed-off-by: Michaela <michaela.sieber@kit.edu>
Comment 15 Jonathan Druart 2025-04-30 19:58:47 UTC
Created attachment 181722 [details] [review]
Bug 38930: Add a permissions store

This patch adds a permissions store to hold a user's permissions and run checks when required

Test plan:
1) Apply the patch and run the following commands
a) yarn build
b) restart_all
2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements
3) Note that the button for New Agreement is visible
4) Choose a random staff user and assign them the following permissions:
- Staff access, allows viewing of the catalogue in staff interface (catalogue)
- Manage Koha system settings (Administration panel) (parameters)
- Acquisition management (acquisition)
- Manage the electronic resources module (erm)
These are the permissions required to access the ERM module
6) Open an incognito browser and log in as the chosen staff member with these permissions
7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work
8) Navigate to the Agreements page again, the button should not be visible
9) Back in your main browser, assign the following permission set to the user:
- Create purchase suggestions (suggestions_create)
10) Hard refresh the incognito browser, the button should now be visible again
Comment 16 Jonathan Druart 2025-04-30 20:54:29 UTC
Created attachment 181723 [details] [review]
Bug 38930: Add a permissions store

This patch adds a permissions store to hold a user's permissions and run checks when required

Test plan:
1) Apply the patch and run the following commands
a) yarn build
b) restart_all
2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements
3) Note that the button for New Agreement is visible
4) Choose a random staff user and assign them the following permissions:
- Staff access, allows viewing of the catalogue in staff interface (catalogue)
- Manage Koha system settings (Administration panel) (parameters)
- Acquisition management (acquisition)
- Manage the electronic resources module (erm)
These are the permissions required to access the ERM module
6) Open an incognito browser and log in as the chosen staff member with these permissions
7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work
8) Navigate to the Agreements page again, the button should not be visible
9) Back in your main browser, assign the following permission set to the user:
- Create purchase suggestions (suggestions_create)
10) Hard refresh the incognito browser, the button should now be visible again

Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 17 Katrin Fischer 2025-05-02 13:11:31 UTC
I think having some notes somewhere for devs might be helfpul?
Comment 18 Katrin Fischer 2025-05-02 15:24:08 UTC
Pushed for 25.05!

Well done everyone, thank you!