[Koha-bugs] [Bug 30780] Librarians with only "place_holds" permissions can not update holds data via REST API

[bugzilla-daemon at bugs.koha-community.org]

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780

David Nind <david at davidnind.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |david at davidnind.com

--- Comment #3 from David Nind <david at davidnind.com> ---
Testing notes using koha-testing-docker:

1. I used the Firefox addon RESTr to test.

2. Place two holds in the staff interface.

3. Change the username and password for a staff patron.

4. List the holds using the REST API and note down the hold_ids:
   - Method: GET
   - URL: http://127.0.0.1/8080/api/v1/holds/
   - Authentication: use koha + koha for basic authentication (or give the
staff patron used Add, modify and view patron information (borrowers) access so
they can view the list of holds)

5. Suspend a hold (where {hold_id} is one of the holds listed in step 3 and
YYYY-MM-DD is a future date):
   - Method: POST
   - URL: http://127.0.0.1:8080/api/v1/holds/{hold_id}/suspension
   - Authentication: staff patron with place_holds permission
   - Body (JSON):
     {
       "end_date": "YYYY-MM-DD"
     }

6. Cancel a hold (where {hold_id} is one of the holds listed in step 3):
   - Method: DELETE
   - URL: http://127.0.0.1:8080/api/v1/holds/{hold_id}
   - Authentication: staff patron with place_holds permission

-- 
You are receiving this mail because:
You are watching all bug changes.