https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43602 --- Comment #2 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 206596 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=206596&action=edit Bug 43602: Add GET /api/v1/article_requests/{article_request_id} and public_read_list Adds the single-resource read action alongside the existing list action, using the same objects.to_api helper, and a _find($c) helper that looks requests up via Koha::ArticleRequests->search_limited so both actions honor the same branch-visibility restriction (a staff user without borrowers: view_borrower_infos_from_any_libraries can only see requests from patrons in libraries they're allowed to see). Also adds public_read_list to Koha::ArticleRequest, needed so a later public-facing endpoint can safely return the article request representation to the patron without leaking the internal debit_id accounting reference. Koha::Object::to_api filters public_read_list BEFORE renaming columns via to_api_mapping, so the list is expressed in DB column names (id, borrowernumber, biblionumber, itemnumber, branchcode, ...), not their API-facing equivalents - getting this wrong would silently drop patron_id/biblio_id/article_request_id/item_id/ library_id from every public response, since Koha::Object::TO_JSON hasn't renamed anything yet at the point the filter runs. Covered by a behavioral test that builds a real article request and asserts the actual keys present in to_api({public => 1}) output, rather than just checking the method's return value against a copy of itself. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.