We need to be able to handle permissions within Vue apps to do things like hiding action buttons or menu options
Created attachment 176826 [details] [review] Bug 38930: Add API endpoint This patch adds an API endpoint to return a hash of a user's permissions
Created attachment 176827 [details] [review] Bug 38930: Add a permissions store This patch adds a permissions store to hold a user's permissions and run checks when required Test plan: 1) Apply the patch and run the following commands a) yarn build b) restart_all 2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements 3) Note that the button for New Agreement is visible 4) Choose a random staff user and assign them the following permissions: - Staff access, allows viewing of the catalogue in staff interface (catalogue) - Manage Koha system settings (Administration panel) (parameters) - Acquisition management (acquisition) - Manage the electronic resources module (erm) These are the permissions required to access the ERM module 6) Open an incognito browser and log in as the chosen staff member with these permissions 7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work 8) Navigate to the Agreements page again, the button should not be visible 9) Back in your main browser, assign the following permission set to the user: - Create purchase suggestions (suggestions_create) 10) Hard refresh the incognito browser, the button should now be visible again
Created attachment 176828 [details] [review] Bug 38930: (DO NOT PUSH) Add an example to ERM
I found the title a bit scary at first, but the patches make sense. No point showing options that users aren't authorized to do.
This looks good. Some remarks however: 1. Missing tests (at least for the new REST API endpoint, but it would be good to have some Cypress tests) 2. (wording) Wondering if "isUserPermitted" should not be closed to what we have in the module: has_permissions. What do you think? 3. About the endpoint, you named it /user_permissions There is a comment in the code: Koha/Patron.pm: flags => undef, # permissions manipulation handled in /permissions And in Koha/REST/V1/ERM.pm: 40 sub config { 49 # TODO Add permissions There are contradicting one another, but we discussed that when we implemented /erm/config and we agreed to have the logged in user's info embedded in this route. I think we should discuss 3. with Tomas.