Bug 40364 - Add permission for viewing patron holds history
Summary: Add permission for viewing patron holds history
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Andrew Fuerste-Henry
QA Contact: Matt Blenkinsop
URL:
Keywords:
Depends on: 32682
Blocks:
  Show dependency treegraph
 
Reported: 2025-07-14 15:56 UTC by Andrew Fuerste-Henry
Modified: 2026-01-30 18:01 UTC (History)
8 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
This enhancement adds a new permission for viewing parton's hold history. ( view_holds_history ) Now when IntranetReadingHistoryHolds is enabled staff must also have the specific 'view_holds_history' permission in order to view a patron's hold history. With IntranetReadingHistoryHolds turned off the no users are able to view patron's hold history.
Version(s) released in:
26.05.00
Circulation function:


Attachments
Bug 40364: Atomicupdate to add permission (2.21 KB, patch)
2025-09-29 20:10 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Implement holds history permission (5.01 KB, patch)
2025-09-29 20:10 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Correct wording of permissions for hold history and checkout history (1.39 KB, patch)
2025-10-02 15:59 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Correct wording of permissions for checkout and holds history (2.62 KB, patch)
2025-10-02 16:23 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Atomicupdate to add permission (2.27 KB, patch)
2025-10-02 18:49 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Implement holds history permission (5.07 KB, patch)
2025-10-02 18:49 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Correct wording of permissions for checkout and holds history (2.68 KB, patch)
2025-10-02 18:49 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Correct system preference check in atomicupdate (1.19 KB, patch)
2025-10-23 19:46 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Update permissions for patron_holds API path (698 bytes, patch)
2025-10-23 19:46 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Correct wording in user permissions (2.64 KB, patch)
2026-01-23 13:58 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Atomicupdate to add permission (2.33 KB, patch)
2026-01-23 14:39 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 40364: Implement holds history permission (5.13 KB, patch)
2026-01-23 14:39 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 40364: Correct system preference check in atomicupdate (1.25 KB, patch)
2026-01-23 14:39 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 40364: Update permissions for patron_holds API path (763 bytes, patch)
2026-01-23 14:39 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 40364: Correct wording in user permissions (2.71 KB, patch)
2026-01-23 14:39 UTC, Matt Blenkinsop
Details | Diff | Splinter Review
Bug 40364: (follow-up) Fix duplicated mapping key issue (842 bytes, patch)
2026-01-30 17:11 UTC, Lucas Gass (lukeg)
Details | Diff | Splinter Review
Bug 40364: Add new permission to t/Koha/Auth/Permissions.t (1.04 KB, patch)
2026-01-30 17:48 UTC, Lucas Gass (lukeg)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Fuerste-Henry 2025-07-14 15:56:11 UTC
Bug 32682 is adding a permission for the ability to view patron checkout history.
We also need a parallel permission for patron holds history. We should make it so when IntranetReadingHistoryHolds is enabled, users with this new permission can see patron hold history but users without the permission cannot. When IntranetReadingHistoryHolds is disabled, no users should be able to see patron hold history.
Comment 1 David Cook 2025-07-14 23:12:22 UTC
Sounds good to me. I think these kinds of more granular permissions restricting access to patron information are increasingly invaluable.
Comment 2 Andrew Fuerste-Henry 2025-09-29 20:10:16 UTC
Created attachment 187065 [details] [review]
Bug 40364: Atomicupdate to add permission
Comment 3 Andrew Fuerste-Henry 2025-09-29 20:10:19 UTC
Created attachment 187066 [details] [review]
Bug 40364: Implement holds history permission

To test:
1 - enable IntranetReadingHistoryHolds system preference
2 - make some holds for a patron, confirm you can see Holds History in the patron record when logged in as a superlibrarian
3 - log in as a non-superlibrarian with edit_borrowers permission, confirm you can see holds history in pthe patron record
4 - apply patch, updatedatabase, restat_all
5 - confirm you can see holds history as a superlibrarian
6 - confirm your non-superlibrarian from step 3 was given view_holds_history permission and can view holds history
7 - remove view_holds_history permission from your user, confirm you can no longer access holds history
Comment 4 Andrew Fuerste-Henry 2025-10-02 15:59:37 UTC
Created attachment 187298 [details] [review]
Bug 40364: Correct wording of permissions for hold history and checkout history

These both said "Viewing" rather than "View"
Comment 5 Andrew Fuerste-Henry 2025-10-02 16:23:54 UTC
Created attachment 187305 [details] [review]
Bug 40364: Correct wording of permissions for checkout and holds history

Changes "Viewing" to "View." In both relevant places!
Comment 6 Andrew Fuerste-Henry 2025-10-02 18:49:19 UTC
Created attachment 187317 [details] [review]
Bug 40364: Atomicupdate to add permission

Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Comment 7 Andrew Fuerste-Henry 2025-10-02 18:49:22 UTC
Created attachment 187318 [details] [review]
Bug 40364: Implement holds history permission

To test:
1 - enable IntranetReadingHistoryHolds system preference
2 - make some holds for a patron, confirm you can see Holds History in the patron record when logged in as a superlibrarian
3 - log in as a non-superlibrarian with edit_borrowers permission, confirm you can see holds history in pthe patron record
4 - apply patch, updatedatabase, restat_all
5 - confirm you can see holds history as a superlibrarian
6 - confirm your non-superlibrarian from step 3 was given view_holds_history permission and can view holds history
7 - remove view_holds_history permission from your user, confirm you can no longer access holds history

Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Comment 8 Andrew Fuerste-Henry 2025-10-02 18:49:24 UTC
Created attachment 187319 [details] [review]
Bug 40364: Correct wording of permissions for checkout and holds history

Changes "Viewing" to "View." In both relevant places!

Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Comment 9 Jonathan Druart 2025-10-07 09:56:07 UTC
I think the REST API route permission needs adjustments:

api/v1/swagger/paths/patrons_holds.yaml
Comment 10 Andrew Fuerste-Henry 2025-10-23 19:46:22 UTC
Created attachment 188394 [details] [review]
Bug 40364: Correct system preference check in atomicupdate
Comment 11 Andrew Fuerste-Henry 2025-10-23 19:46:24 UTC
Created attachment 188395 [details] [review]
Bug 40364: Update permissions for patron_holds API path
Comment 12 Matt Blenkinsop 2026-01-23 12:14:35 UTC
Applying: Bug 40364: Correct wording of permissions for checkout and holds history
error: sha1 information is lacking or useless (installer/data/mysql/mandatory/userpermissions.sql).
error: could not build fake ancestor
Patch failed at 0001 Bug 40364: Correct wording of permissions for checkout and holds history
Comment 13 Andrew Fuerste-Henry 2026-01-23 13:50:48 UTC
Comment on attachment 187319 [details] [review]
Bug 40364: Correct wording of permissions for checkout and holds history

Obsoleting out the problem patch, which is just two tiny wording changes.
Comment 14 Andrew Fuerste-Henry 2026-01-23 13:58:34 UTC
Created attachment 191939 [details] [review]
Bug 40364: Correct wording in user permissions

Changes the descriptions of the holds history and checkout history permissions to say "view" rather than "viewing"
Comment 15 Matt Blenkinsop 2026-01-23 14:39:21 UTC
Created attachment 191944 [details] [review]
Bug 40364: Atomicupdate to add permission

Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Comment 16 Matt Blenkinsop 2026-01-23 14:39:23 UTC
Created attachment 191945 [details] [review]
Bug 40364: Implement holds history permission

To test:
1 - enable IntranetReadingHistoryHolds system preference
2 - make some holds for a patron, confirm you can see Holds History in the patron record when logged in as a superlibrarian
3 - log in as a non-superlibrarian with edit_borrowers permission, confirm you can see holds history in pthe patron record
4 - apply patch, updatedatabase, restat_all
5 - confirm you can see holds history as a superlibrarian
6 - confirm your non-superlibrarian from step 3 was given view_holds_history permission and can view holds history
7 - remove view_holds_history permission from your user, confirm you can no longer access holds history

Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Comment 17 Matt Blenkinsop 2026-01-23 14:39:26 UTC
Created attachment 191946 [details] [review]
Bug 40364: Correct system preference check in atomicupdate

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Comment 18 Matt Blenkinsop 2026-01-23 14:39:28 UTC
Created attachment 191947 [details] [review]
Bug 40364: Update permissions for patron_holds API path

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Comment 19 Matt Blenkinsop 2026-01-23 14:39:30 UTC
Created attachment 191948 [details] [review]
Bug 40364: Correct wording in user permissions

Changes the descriptions of the holds history and checkout history permissions to say "view" rather than "viewing"

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Comment 20 Lucas Gass (lukeg) 2026-01-30 17:05:18 UTC
This breaks the yarn build process:

bundling api/v1/swagger/swagger.yaml...
[1] api/v1/swagger/paths/patrons_holds.yaml:80:9 

Failed to parse: duplicated mapping key in "/kohadevbox/koha/api/v1/swagger/paths/patrons_holds.yaml" (80:9)

78 | permissions:
79 |   borrowers: edit_borrowers
80 |   borrowers: view_holds_history
81 |

Error was generated by the bundler rule.


[2] api/v1/swagger/swagger.yaml:511:5 at #/paths/~1patrons~1{patron_id}~1holds

Can't resolve $ref: duplicated mapping key in "/kohadevbox/koha/api/v1/swagger/paths/patrons_holds.yaml" (80:9)

509 |   $ref: "./paths/patrons_extended_attributes.yaml#/~1patrons~1{patron_id}~1extended_attributes~1{extended_attribute_id}"
510 | "/patrons/{patron_id}/holds":
511 |   $ref: "./paths/patrons_holds.yaml#/~1patrons~1{patron_id}~1holds"
512 | "/patrons/{patron_id}/hold_groups":
513 |   $ref: "./paths/patrons_hold_groups.yaml#/~1patrons~1{patron_id}~1hold_groups"
Comment 21 Lucas Gass (lukeg) 2026-01-30 17:11:52 UTC
Created attachment 192257 [details] [review]
Bug 40364: (follow-up) Fix duplicated mapping key issue
Comment 22 Lucas Gass (lukeg) 2026-01-30 17:48:31 UTC
Created attachment 192262 [details] [review]
Bug 40364: Add new permission to t/Koha/Auth/Permissions.t
Comment 23 Lucas Gass (lukeg) 2026-01-30 17:56:06 UTC
Nice work everyone!

Pushed to main for 26.05