With a restricted libarian account (only some acq permissions) it is not possible to see or edit vendors in acquisition . The error message "Something went wrong: Error: Authorization failure. Missing required permission(s)." appears. The patron would need the acquisition permissions which includes budget permissions among other things, otherwise the API blocks the request. To recreate: 1. Log in as superlibrarian 2. Search for a user, for example borrowernumber=17 7. Give permissions for catalogue (staff access) and manage_vendors 8. Log in with this account 9. Go to Acquisition module 10. Click on Search Vendors Check that the error message mentioned above appears
I think this is major as it could be a very big issue for libraries that don't want to give the _all permissions in a consortial setting. But also if someone only needs vendors for working with the serials or ERM module. Updating severity.
Created attachment 186027 [details] [review] Bug 40684: Adjust permissions for vendors The acquisition config route should be accessible to users with at least one acquisition subpermission or erm permission. The list vendors route should be accessible to users with the erm permission.
This patch fixed the original problem, but there are more to fix it seems. the erm module is still not loading properly (I guess it can be fixed later). How do you feel about this patch, Matt?
Created attachment 186889 [details] [review] Bug 40684: Adjust permissions for vendors The acquisition config route should be accessible to users with at least one acquisition subpermission or erm permission. The list vendors route should be accessible to users with the erm permission. Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 186891 [details] [review] Bug 40684: Adjust permissions for vendors The acquisition config route should be accessible to users with at least one acquisition subpermission or erm permission. The list vendors route should be accessible to users with the erm permission. Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
I think this is the best solution for now, PQA
Nice work everyone! Pushed to main for 25.11
Can this be back ported to 25.05?
(In reply to Christopher Brannon from comment #8) > Can this be back ported to 25.05? I second this request. Thank you for considering!
+1 Katrin's comment re: issue severity for consortial settings +1 on the backporting request
Nice work everyone! Pushed to 25.05.x