https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42383 --- Comment #79 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 209739 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209739&action=edit Bug 42383: Add Koha::Module::Policy framework This patch adds a module policy framework that exposes per-module capabilities to the UI. This replaces the pattern of dedicated GET /config endpoints (like GET /erm/config) with a reactive, session-scoped mechanism. A module policy is the intersection of: - System preferences (feature toggles) - User permissions (what this staff member can do) - Library context (branch-specific configuration) The policy is a plain JSON structure: an envelope with the `module` name, a `global` block with the keys common to all modules, and the module-specific keys under the module name: { module => 'checkin', global => { audio_alerts => true, ... }, checkin => { exempt_fine => false, ... }, } Flags are JSON booleans. Modules cannot override the global keys, as they live in their own namespace. The page is bootstrapped with the policy, and the API returns it in the error object when it refuses a request because of it, so the client can refresh the UI. The server remains authoritative - the policy is informational, not an access token. Components: - Koha::Module::Policy - Base class with new(), module(), to_hashref() and scope() - Koha::Module::Policy::Checkin - Checkin module policy covering fines, holds, recalls, transfers, display, and blockers Test plan: 1. Apply patch 2. Run: $ ktd --shell k$ prove t/db_dependent/Koha/Module/Policy.t \ t/db_dependent/Koha/Module/Policy/Checkin.t => SUCCESS: Tests pass 3. Tests cover: - Base class constructor validation - Abstract method enforcement - scope() derivation from class name - The policy envelope, and globals not being overridable by modules - Permission-gated capabilities (exempt_fine, forgive_hold_fees) - Superlibrarian vs limited user - Flags being JSON booleans 4. Sign off :-D Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.