Bug 40684 - Permission error for vendors if user has not full acquisition module permission
Summary: Permission error for vendors if user has not full acquisition module permission
Status: Pushed to stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Acquisitions (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Jonathan Druart
QA Contact: Matt Blenkinsop
URL:
Keywords:
Depends on: 38010
Blocks: 40868
  Show dependency treegraph
 
Reported: 2025-08-21 15:53 UTC by Michaela Sieber
Modified: 2025-09-26 14:42 UTC (History)
11 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.11.00,25.05.04
Circulation function:


Attachments
Bug 40684: Adjust permissions for vendors (1.70 KB, patch)
2025-09-02 08:18 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 40684: Adjust permissions for vendors (1.75 KB, patch)
2025-09-24 14:52 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 40684: Adjust permissions for vendors (1.81 KB, patch)
2025-09-24 14:55 UTC, Matt Blenkinsop
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Michaela Sieber 2025-08-21 15:53:43 UTC
With a restricted libarian account (only some acq permissions) it is not possible to see or edit vendors in acquisition . 
The error message "Something went wrong: Error: Authorization failure. Missing required permission(s)." appears.

The patron would need the acquisition permissions which includes budget permissions among other things, otherwise the API blocks the request.


To recreate:
1. Log in as superlibrarian
2. Search for a user, for example borrowernumber=17
7. Give permissions for catalogue (staff access) and manage_vendors
8. Log in with this account
9. Go to Acquisition module
10. Click on Search Vendors
Check that the error message mentioned above appears
Comment 1 Katrin Fischer 2025-08-25 13:08:58 UTC
I think this is major as it could be a very big issue for libraries that don't want to give the _all permissions in a consortial setting. But also if someone only needs vendors for working with the serials or ERM module.

Updating severity.
Comment 2 Jonathan Druart 2025-09-02 08:18:54 UTC
Created attachment 186027 [details] [review]
Bug 40684: Adjust permissions for vendors

The acquisition config route should be accessible to users
with at least one acquisition subpermission or erm permission.

The list vendors route should be accessible to users with the erm
permission.
Comment 3 Jonathan Druart 2025-09-02 08:20:06 UTC
This patch fixed the original problem, but there are more to fix it seems. the erm module is still not loading properly (I guess it can be fixed later).

How do you feel about this patch, Matt?
Comment 4 Nick Clemens (kidclamp) 2025-09-24 14:52:55 UTC
Created attachment 186889 [details] [review]
Bug 40684: Adjust permissions for vendors

The acquisition config route should be accessible to users
with at least one acquisition subpermission or erm permission.

The list vendors route should be accessible to users with the erm
permission.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 5 Matt Blenkinsop 2025-09-24 14:55:29 UTC
Created attachment 186891 [details] [review]
Bug 40684: Adjust permissions for vendors

The acquisition config route should be accessible to users
with at least one acquisition subpermission or erm permission.

The list vendors route should be accessible to users with the erm
permission.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Comment 6 Matt Blenkinsop 2025-09-24 14:56:06 UTC
I think this is the best solution for now, PQA
Comment 7 Lucas Gass (lukeg) 2025-09-24 15:26:41 UTC
Nice work everyone!

Pushed to main for 25.11
Comment 8 Christopher Brannon 2025-09-24 15:58:10 UTC
Can this be back ported to 25.05?
Comment 9 Rebecca Coert 2025-09-24 20:33:30 UTC
(In reply to Christopher Brannon from comment #8)
> Can this be back ported to 25.05?

I second this request.  Thank you for considering!
Comment 10 Michelle Spinney 2025-09-24 21:43:56 UTC
+1 Katrin's comment re: issue severity for consortial settings
+1 on the backporting request
Comment 11 Paul Derscheid 2025-09-25 16:30:35 UTC
Nice work everyone!

Pushed to 25.05.x