At the moment librarians with place_holds permission can add and modify holds on request.pl page. This is not possible via REST API, the POST and PATCH endpoints need reserveforothers permission to work.
Created attachment 193339 [details] [review] Bug 41869: Change place_holds permission to /holds POST and PATCH This patch changes the place_holds permission to be required for POST and PATCH requests to /holds.
How to test/test plan? Steps to test using an API client required (for example, using Bruno). The tests pass before and after the patch: prove t/db_dependent/api/v1/holds.t
Created attachment 193372 [details] [review] Bug 41869: Change place_holds permission to /holds POST and PATCH This patch changes the place_holds permission to be required for POST and PATCH requests to /holds. Test plan: 1. Create a patron with the place_holds permission. 2. Try to add (POST) a hold to /holds and verify that it is forbidden. 3. Try to edit (PATCH) a hold to /holds and verify that it is forbidden. 4. Apply the patch and repeat steps 2 and 3, verifying that the requests are now allowed. 5. prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy
Created attachment 193496 [details] [review] Bug 41869: Change place_holds permission to /holds POST and PATCH This patch changes the place_holds permission to be required for POST and PATCH requests to /holds. Test plan: 1. Create a patron with the place_holds permission. 2. Try to add (POST) a hold to /holds and verify that it is forbidden. 3. Try to edit (PATCH) a hold to /holds and verify that it is forbidden. 4. Apply the patch and repeat steps 2 and 3, verifying that the requests are now allowed. 5. prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy
Thanks for the test plan! For a non-developer like myself, steps 2 and 3 are a bit of a mystery 8-) I muddled through, here are my testing notes (using KTD): 1. Edit Henry Acevedo's account so that you can log in as Henry. 2. Set Henry's permissions: - Staff access, allows viewing of catalogue in staff interface (catalogue) - Place and modify holds for patrons (reserveforothers) - Add, modify and view patron information (borrowers) 3. Test placing and modifying a hold using the API, using Henry's credentials (I used Bruno https://www.usebruno.com/) - these should be successful. (I used Mary Burton (patron_id = 49) as the patron and Programming perl (biblio_id = 262) for the record.) 3.1 Place a hold: POST 127.0.0.1:8081/api/v1/holds Auth: Basic Auth with Henry's username and password Body (JSON): { "patron_id": "49", "biblio_id": "262", "pickup_library_id": "CPL" } 3.2 Modify a hold (changes the hold date) (assuming the hold_id = "1"*, adjust as appropriate): PATCH 127.0.0.1:8081/api/v1/holds/1 Auth: Basic Auth with Henry's username and password Body (JSON): { "hold_date": "2026-02-17", "pickup_library_id": "CPL" } * To find the hold_id: - Access the database: koha-mysql kohadev - List the holds: select * from reserves; 4. Delete the hold created for Mary, using the staff interface. 5. Change Henry's permissions: - remove "Move holds between items and records (alter_hold_targets)" permission (leaves "Modify holds priority (modify_holds_priority)" and "Place holds for patrons (place_holds)" selected) 6. Test placing and modifying a hold using the API as per steps 3.1 and 3.2 - should return an error: 403 error returned: { "error": "Authorization failure. Missing required permission(s).", "required_permissions": { "reserveforothers": "1" } } 7. Test placing a hold as Henry using the staff interface - this should be successful! 8. Delete the hold created, using the staff interface. 8. Apply the patch, run yarn build, and restart everything (restart_all). 9. Repeat steps 3.1 and 3.2 - these should now be successful. 10. Repeat step 7 - this should be successful. 11. The tests should pass: prove t/db_dependent/api/v1/holds.t