Bug 41869 - Change /holds POST and PATCH permission to place_holds
Summary: Change /holds POST and PATCH permission to place_holds
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Johanna Räisä
QA Contact: Testopia
URL:
Keywords: release-notes-needed
Depends on:
Blocks:
 
Reported: 2026-02-18 08:47 UTC by Johanna Räisä
Modified: 2026-02-19 20:09 UTC (History)
2 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: Sponsored
Comma delimited list of Sponsors: Koha-Suomi Oy
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 41869: Change place_holds permission to /holds POST and PATCH (5.36 KB, patch)
2026-02-18 10:21 UTC, Johanna Räisä
Details | Diff | Splinter Review
Bug 41869: Change place_holds permission to /holds POST and PATCH (5.64 KB, patch)
2026-02-19 06:43 UTC, Johanna Räisä
Details | Diff | Splinter Review
Bug 41869: Change place_holds permission to /holds POST and PATCH (5.64 KB, patch)
2026-02-19 20:00 UTC, David Nind
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Johanna Räisä 2026-02-18 08:47:37 UTC
At the moment librarians with place_holds permission can add and modify holds on request.pl page. This is not possible via REST API, the POST and PATCH endpoints need reserveforothers permission to work.
Comment 1 Johanna Räisä 2026-02-18 10:21:20 UTC
Created attachment 193339 [details] [review]
Bug 41869: Change place_holds permission to /holds POST and PATCH

This patch changes the place_holds permission to be required for POST and PATCH requests to /holds.
Comment 2 David Nind 2026-02-18 22:10:01 UTC
How to test/test plan? Steps to test using an API client required (for example, using Bruno).

The tests pass before and after the patch: prove t/db_dependent/api/v1/holds.t
Comment 3 Johanna Räisä 2026-02-19 06:43:11 UTC
Created attachment 193372 [details] [review]
Bug 41869: Change place_holds permission to /holds POST and PATCH

This patch changes the place_holds permission to be required for POST and PATCH requests to /holds.

Test plan:
1. Create a patron with the place_holds permission.
2. Try to add (POST) a hold to /holds and verify that it is forbidden.
3. Try to edit (PATCH) a hold to /holds and verify that it is forbidden.
4. Apply the patch and repeat steps 2 and 3, verifying that the requests are now allowed.
5. prove t/db_dependent/api/v1/holds.t

Sponsored-by: Koha-Suomi Oy
Comment 4 David Nind 2026-02-19 20:00:30 UTC
Created attachment 193496 [details] [review]
Bug 41869: Change place_holds permission to /holds POST and PATCH

This patch changes the place_holds permission to be required for POST and PATCH requests to /holds.

Test plan:
1. Create a patron with the place_holds permission.
2. Try to add (POST) a hold to /holds and verify that it is forbidden.
3. Try to edit (PATCH) a hold to /holds and verify that it is forbidden.
4. Apply the patch and repeat steps 2 and 3, verifying that the requests are now allowed.
5. prove t/db_dependent/api/v1/holds.t

Sponsored-by: Koha-Suomi Oy
Comment 5 David Nind 2026-02-19 20:09:15 UTC
Thanks for the test plan!

For a non-developer like myself, steps 2 and 3 are a bit of a mystery 8-)

I muddled through, here are my testing notes (using KTD):

1. Edit Henry Acevedo's account so that you can log in as Henry.

2. Set Henry's permissions:
   - Staff access, allows viewing of catalogue in staff interface (catalogue) 
   - Place and modify holds for patrons (reserveforothers)
   - Add, modify and view patron information (borrowers)

3. Test placing and modifying a hold using the API, using Henry's credentials (I used Bruno https://www.usebruno.com/) - these should be successful. (I used Mary Burton (patron_id = 49) as the patron and Programming perl (biblio_id = 262) for the record.)

3.1 Place a hold:

     POST 127.0.0.1:8081/api/v1/holds
     Auth: Basic Auth with Henry's username and password
     Body (JSON):
      {
        "patron_id": "49",
        "biblio_id": "262",
        "pickup_library_id": "CPL"
      }

3.2 Modify a hold (changes the hold date) (assuming the hold_id = "1"*, adjust as appropriate):

     PATCH 127.0.0.1:8081/api/v1/holds/1
     Auth: Basic Auth with Henry's username and password
     Body (JSON):
      {
        "hold_date": "2026-02-17",
         "pickup_library_id": "CPL"
      }
     
    * To find the hold_id:
      - Access the database: koha-mysql kohadev
      - List the holds: select * from reserves;

4. Delete the hold created for Mary, using the staff interface.

5. Change Henry's permissions: 
   - remove "Move holds between items and records (alter_hold_targets)" permission
     (leaves "Modify holds priority (modify_holds_priority)" and "Place holds for patrons (place_holds)" selected)

6. Test placing and modifying a hold using the API as per steps 3.1 and 3.2 - should return an error:

     403 error returned:
      {
        "error": "Authorization failure. Missing required permission(s).",
        "required_permissions": {
        "reserveforothers": "1"
        }
      }

7. Test placing a hold as Henry using the staff interface - this should
   be successful!

8. Delete the hold created, using the staff interface.

8. Apply the patch, run yarn build, and restart everything (restart_all).

9. Repeat steps 3.1 and 3.2 - these should now be successful.

10. Repeat step 7 - this should be successful.

11. The tests should pass: prove t/db_dependent/api/v1/holds.t