Bug 32682 is adding a permission for the ability to view patron checkout history. We also need a parallel permission for patron holds history. We should make it so when IntranetReadingHistoryHolds is enabled, users with this new permission can see patron hold history but users without the permission cannot. When IntranetReadingHistoryHolds is disabled, no users should be able to see patron hold history.
Sounds good to me. I think these kinds of more granular permissions restricting access to patron information are increasingly invaluable.
Created attachment 187065 [details] [review] Bug 40364: Atomicupdate to add permission
Created attachment 187066 [details] [review] Bug 40364: Implement holds history permission To test: 1 - enable IntranetReadingHistoryHolds system preference 2 - make some holds for a patron, confirm you can see Holds History in the patron record when logged in as a superlibrarian 3 - log in as a non-superlibrarian with edit_borrowers permission, confirm you can see holds history in pthe patron record 4 - apply patch, updatedatabase, restat_all 5 - confirm you can see holds history as a superlibrarian 6 - confirm your non-superlibrarian from step 3 was given view_holds_history permission and can view holds history 7 - remove view_holds_history permission from your user, confirm you can no longer access holds history
Created attachment 187298 [details] [review] Bug 40364: Correct wording of permissions for hold history and checkout history These both said "Viewing" rather than "View"
Created attachment 187305 [details] [review] Bug 40364: Correct wording of permissions for checkout and holds history Changes "Viewing" to "View." In both relevant places!
Created attachment 187317 [details] [review] Bug 40364: Atomicupdate to add permission Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Created attachment 187318 [details] [review] Bug 40364: Implement holds history permission To test: 1 - enable IntranetReadingHistoryHolds system preference 2 - make some holds for a patron, confirm you can see Holds History in the patron record when logged in as a superlibrarian 3 - log in as a non-superlibrarian with edit_borrowers permission, confirm you can see holds history in pthe patron record 4 - apply patch, updatedatabase, restat_all 5 - confirm you can see holds history as a superlibrarian 6 - confirm your non-superlibrarian from step 3 was given view_holds_history permission and can view holds history 7 - remove view_holds_history permission from your user, confirm you can no longer access holds history Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Created attachment 187319 [details] [review] Bug 40364: Correct wording of permissions for checkout and holds history Changes "Viewing" to "View." In both relevant places! Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
I think the REST API route permission needs adjustments: api/v1/swagger/paths/patrons_holds.yaml
Created attachment 188394 [details] [review] Bug 40364: Correct system preference check in atomicupdate
Created attachment 188395 [details] [review] Bug 40364: Update permissions for patron_holds API path