Bug 40364 - Add permission for viewing patron holds history
Summary: Add permission for viewing patron holds history
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Circulation (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Andrew Fuerste-Henry
QA Contact: Testopia
URL:
Keywords:
Depends on: 32682
Blocks:
  Show dependency treegraph
 
Reported: 2025-07-14 15:56 UTC by Andrew Fuerste-Henry
Modified: 2025-10-23 19:46 UTC (History)
6 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 40364: Atomicupdate to add permission (2.21 KB, patch)
2025-09-29 20:10 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Implement holds history permission (5.01 KB, patch)
2025-09-29 20:10 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Correct wording of permissions for hold history and checkout history (1.39 KB, patch)
2025-10-02 15:59 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Correct wording of permissions for checkout and holds history (2.62 KB, patch)
2025-10-02 16:23 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Atomicupdate to add permission (2.27 KB, patch)
2025-10-02 18:49 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Implement holds history permission (5.07 KB, patch)
2025-10-02 18:49 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Correct wording of permissions for checkout and holds history (2.68 KB, patch)
2025-10-02 18:49 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Correct system preference check in atomicupdate (1.19 KB, patch)
2025-10-23 19:46 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review
Bug 40364: Update permissions for patron_holds API path (698 bytes, patch)
2025-10-23 19:46 UTC, Andrew Fuerste-Henry
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Fuerste-Henry 2025-07-14 15:56:11 UTC
Bug 32682 is adding a permission for the ability to view patron checkout history.
We also need a parallel permission for patron holds history. We should make it so when IntranetReadingHistoryHolds is enabled, users with this new permission can see patron hold history but users without the permission cannot. When IntranetReadingHistoryHolds is disabled, no users should be able to see patron hold history.
Comment 1 David Cook 2025-07-14 23:12:22 UTC
Sounds good to me. I think these kinds of more granular permissions restricting access to patron information are increasingly invaluable.
Comment 2 Andrew Fuerste-Henry 2025-09-29 20:10:16 UTC
Created attachment 187065 [details] [review]
Bug 40364: Atomicupdate to add permission
Comment 3 Andrew Fuerste-Henry 2025-09-29 20:10:19 UTC
Created attachment 187066 [details] [review]
Bug 40364: Implement holds history permission

To test:
1 - enable IntranetReadingHistoryHolds system preference
2 - make some holds for a patron, confirm you can see Holds History in the patron record when logged in as a superlibrarian
3 - log in as a non-superlibrarian with edit_borrowers permission, confirm you can see holds history in pthe patron record
4 - apply patch, updatedatabase, restat_all
5 - confirm you can see holds history as a superlibrarian
6 - confirm your non-superlibrarian from step 3 was given view_holds_history permission and can view holds history
7 - remove view_holds_history permission from your user, confirm you can no longer access holds history
Comment 4 Andrew Fuerste-Henry 2025-10-02 15:59:37 UTC
Created attachment 187298 [details] [review]
Bug 40364: Correct wording of permissions for hold history and checkout history

These both said "Viewing" rather than "View"
Comment 5 Andrew Fuerste-Henry 2025-10-02 16:23:54 UTC
Created attachment 187305 [details] [review]
Bug 40364: Correct wording of permissions for checkout and holds history

Changes "Viewing" to "View." In both relevant places!
Comment 6 Andrew Fuerste-Henry 2025-10-02 18:49:19 UTC
Created attachment 187317 [details] [review]
Bug 40364: Atomicupdate to add permission

Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Comment 7 Andrew Fuerste-Henry 2025-10-02 18:49:22 UTC
Created attachment 187318 [details] [review]
Bug 40364: Implement holds history permission

To test:
1 - enable IntranetReadingHistoryHolds system preference
2 - make some holds for a patron, confirm you can see Holds History in the patron record when logged in as a superlibrarian
3 - log in as a non-superlibrarian with edit_borrowers permission, confirm you can see holds history in pthe patron record
4 - apply patch, updatedatabase, restat_all
5 - confirm you can see holds history as a superlibrarian
6 - confirm your non-superlibrarian from step 3 was given view_holds_history permission and can view holds history
7 - remove view_holds_history permission from your user, confirm you can no longer access holds history

Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Comment 8 Andrew Fuerste-Henry 2025-10-02 18:49:24 UTC
Created attachment 187319 [details] [review]
Bug 40364: Correct wording of permissions for checkout and holds history

Changes "Viewing" to "View." In both relevant places!

Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Comment 9 Jonathan Druart 2025-10-07 09:56:07 UTC
I think the REST API route permission needs adjustments:

api/v1/swagger/paths/patrons_holds.yaml
Comment 10 Andrew Fuerste-Henry 2025-10-23 19:46:22 UTC
Created attachment 188394 [details] [review]
Bug 40364: Correct system preference check in atomicupdate
Comment 11 Andrew Fuerste-Henry 2025-10-23 19:46:24 UTC
Created attachment 188395 [details] [review]
Bug 40364: Update permissions for patron_holds API path