https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 --- Comment #1 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 208549 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208549&action=edit Bug 43486: Add permission-gated notification_summary patron embed Adds a `notification_summary` embed to the patron API, exposing how the patron will be notified: { hold_fill_notified => 0|1, primary_contact_method => 'email' } This is patron information, so it must not leak to consumers that are not allowed to see the patron. The generic embed machinery computes embeds via a bare accessor ($patron->notification_summary) with no requesting-user context and cannot enforce that gate itself, and the parent redaction in to_api runs before embeds are attached. So Koha::Patron->to_api strips the notification_summary out after the fact when the requesting user is not allowed to see the patron (is_accessible / can_see_patron_infos). This unblocks the Vue checkin page (bug 42383), which needs to display the "is notified" / "main contact method" information the legacy returns.pl dialog shows, without leaking patron data. Test plan: 1. Apply patch 2. Run: $ ktd --shell k$ prove t/db_dependent/Koha/Patrons.t t/db_dependent/api/v1/patrons.t => SUCCESS: Tests pass, including the gating subtest 3. GET /patrons/:id?x-koha-embed=notification_summary as a user who can see the patron => SUCCESS: response includes notification_summary 4. Repeat as a user who cannot see the patron (no view_borrower_infos_from_any_libraries, ft_hide_patron_info group) => SUCCESS: notification_summary is absent 5. Sign off :-D Assisted-by: Sonnet 4.6 (Anthropic) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.