./catalogue/updateitem.pl is a bit of a nightmare especially in terms of user permissions. It could be useful to replace it with an API endpoint or endpoints. It's interesting to note that out of 7 ops, only 2 of them currently require a catalogue permission. The other 5 are all handled by circulate_remaining_permissions, which... is interesting.