https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10190 --- Comment #874 from Chloé Zermatten <chloe.zermatten@openfifth.co.uk> --- Created attachment 204860 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204860&action=edit Bug 10190: (QA follow-up): fix: permissions Important note: the following assumes manage_circ_triggers is intended as a sibling to manage_circ_rules, and that of the two, only manage_circ_triggers ought to grant access to client-side circulation trigger configuration actions. When manage_circ_triggers was introduced, it was not applied client-side, resulting in the router and menu permission checks incorrectly expecting manage_circ_rules. Amend that. Additionally, while the API endpoint blocked a user with only manage_circ_triggers from editing non-triggers circulation rules, it did not block a user with only manage_circ_rules from editing trigger circulation rules. Add a guard clause. Test plan (based on comment 872): A) Go to a patron's 'More' > 'Set permissions' tab. Check 'catalogue' (needed for basic staff login), and under circulation-rules sub-permissions, check only 'Manage overdue notice triggers' - leave 'Manage circulation rules' unchecked. B) Log in as that patron, go to 'Administration' - 'Circulation triggers' link present (admin-home.tt now correctly checks CAN_user_parameters_manage_circ_triggers), 'Circulation and fine rules' is not present. C) Visit http://localhost:8081/cgi-bin/koha/admin/circulation_triggers directly - you are granted access. D) Confirm that you can create and edit circulation triggers. E) Go to a patron's 'More' > 'Set permissions' tab. Check 'catalogue' (needed for basic staff login), and under circulation-rules sub-permissions, check only 'Manage circulation rules' - leave 'Manage overdue notice triggers' unchecked. F) Log in as that patron, go to 'Administration' - no 'Circulation triggers' link present (as we require manage_circ_triggers), however 'Circulation and fine rules' is present. G) Visit http://localhost:8081/cgi-bin/koha/admin/circulation_triggers directly - you see "Error: You do not have permission to access this page" and are prompted to log in as a different user (as we require manage_circ_triggers). H) Go to http://localhost:8081/cgi-bin/koha/admin/smart-rules.pl, and confirm that you can edit circulation rules for your library (no regression). Assisted-by: Claude Opus 5 (Anthropic) Sponsored-by: Glasgow Colleges Library Group <https://library.cityofglasgowcollege.ac.uk> -- You are receiving this mail because: You are watching all bug changes.