https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42383 --- Comment #117 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 209777 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209777&action=edit Bug 42383: (QA follow-up) Reject follow-up actions on stale checkins This patch makes the checkin follow-up endpoints refuse to act on a checkin that is not the latest checkin of its item: - POST /checkins/{checkin_id}/hold_confirmation - POST /checkins/{checkin_id}/hold_cancellation - POST /checkins/{checkin_id}/transfer_confirmation - POST /checkins/{checkin_id}/transfer_cancellation - POST /checkins/{checkin_id}/recall_confirmation Before, they only checked the permission and that the checkin existed, so an old checkin_id could be used to alter holds, transfers or recalls long after the item had circulated again. A new Koha::Checkin->is_latest method tells whether a later checkin exists for the item. The endpoints now return a 409 with the 'stale_checkin' error_code when it is not the latest. The shared lookup is done in a new _get_actionable_checkin controller helper. It addresses point 13 (a) of the QA comment. Test plan: 1. Apply this patch 2. Run: $ ktd --shell k$ yarn api:bundle k$ prove t/db_dependent/Koha/Checkin.t \ t/db_dependent/api/v1/checkins.t \ xt/api.t => SUCCESS: Tests pass! 3. Sign off :-D Assisted-by: Opus 5.5 (Anthropic) -- You are receiving this mail because: You are watching all bug changes.