Bug 41269 - Patrons subpermissions should be fetched with borrowernumber instead of userid
Summary: Patrons subpermissions should be fetched with borrowernumber instead of userid
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low trivial
Assignee: Emmi Takkinen
QA Contact: Testopia
URL:
Keywords: release-notes-needed
Depends on:
Blocks:
 
Reported: 2025-11-19 09:12 UTC by Emmi Takkinen
Modified: 2026-01-04 18:26 UTC (History)
2 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 41269: Use borrowernumber to fetch patrons subpermissions (3.55 KB, patch)
2025-12-03 09:16 UTC, Emmi Takkinen
Details | Diff | Splinter Review
Bug 41269: Use borrowernumber to fetch patrons subpermissions (3.60 KB, patch)
2026-01-04 18:25 UTC, David Nind
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Emmi Takkinen 2025-11-19 09:12:19 UTC
In Koha-Suomi libraries we use cardnumbers as userids. This is done with a database trigger which sets cardnumber as userid when user is saved to database. Mostly this works well, but occasionally we have faced problems with patrons seemingly having no subpermissions.  

Patrons subpermissions are fetched from database with method get_user_subpermissions based on their userid. So even if they are saved in database they are not displayed in Koha's UI if userid is missing. While this isn't a major problem it can be confusing for staff members if they have accidentally created a patron without cardnumber/userid and then try to save permissions for them which seemingly are not saved. Also full permissions for patrons are still displayed normally so for consistency it would be logical to use borrowernumber to fetch subpermissions instead of userid.    

Method get_user_subpermissions is used in two places, member-flags.pl to fetch subpermissions and about.pl to check that SCO patron doesn't have extra permissions. As far as I can see changing it to use patrons borrowernumber shouldn't have any dramatic side effects.
Comment 1 Emmi Takkinen 2025-12-03 09:16:31 UTC
Created attachment 190103 [details] [review]
Bug 41269: Use borrowernumber to fetch patrons subpermissions

Koha currently fetches patrons subpermissions with userid in
method get_user_subpermissions. If for some reason patron
doesn't have userid their subpermissions aren't displayed
on Koha UI. Althougt this shouldn't really happen (unless there
are some local use cases where userid can be empty), this method
is only used to either display patrons subpermissions on page
Set permissions or to check if SCO user only has SCO permissions.
In both of these cases we can use patrons borrowernumber
instead of userid since they check existing patrons permissions,
not the ones for patron who is about to log into Koha.

To test:
1. Apply this patch.
2. Enable sysprefs WebBasedSelfCheck and AutoSelfCheckAllowed
and add some patrons userid to AutoSelfCheckID.
3. Make sure patron whose userid you used doesn't have
permissions to use SCO and has other subpermissions instead.
4. Navigate to page About Koha>System infromation.
=> Confirm that warnings starting with "The patron used for
the self-checkout..." are displayed.
5. Check patrons permissions.
=> Confirm that patrons subpermissions are displayed normally.

Sponsored-by: Koha-Suomi Oy
Comment 2 David Nind 2026-01-04 18:25:04 UTC
Created attachment 190875 [details] [review]
Bug 41269: Use borrowernumber to fetch patrons subpermissions

Koha currently fetches patrons subpermissions with userid in
method get_user_subpermissions. If for some reason patron
doesn't have userid their subpermissions aren't displayed
on Koha UI. Althougt this shouldn't really happen (unless there
are some local use cases where userid can be empty), this method
is only used to either display patrons subpermissions on page
Set permissions or to check if SCO user only has SCO permissions.
In both of these cases we can use patrons borrowernumber
instead of userid since they check existing patrons permissions,
not the ones for patron who is about to log into Koha.

To test:
1. Apply this patch.
2. Enable sysprefs WebBasedSelfCheck and AutoSelfCheckAllowed
and add some patrons userid to AutoSelfCheckID.
3. Make sure patron whose userid you used doesn't have
permissions to use SCO and has other subpermissions instead.
4. Navigate to page About Koha>System infromation.
=> Confirm that warnings starting with "The patron used for
the self-checkout..." are displayed.
5. Check patrons permissions.
=> Confirm that patrons subpermissions are displayed normally.

Sponsored-by: Koha-Suomi Oy
Signed-off-by: David Nind <david@davidnind.com>