[Bug 43486] New: Add permission-gated patron notification info to the checkin hold.patron embed
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 Bug ID: 43486 Summary: Add permission-gated patron notification info to the checkin hold.patron embed Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs@lists.koha-community.org Reporter: tomascohen@gmail.com QA Contact: tomascohen@gmail.com CC: tomascohen@gmail.com Blocks: 42383 Target Milestone: --- The checkin REST API (bug 24401) can embed the hold's patron via hold.patron, and the Vue checkin page (bug 42383) uses it to render the "Hold found" dialog. Two things are missing compared to the legacy returns.pl dialog: * The embedded patron is not gated by patron-information visibility. The staff interface hides patron identity when the logged-in user can_see_patrons_from() the patron's library returns false (the borrowers => view_borrower_infos_from_any_libraries permission and the ft_hide_patron_info library group feature). The API embed should honour the same rule and redact the patron when the operator may not see it. * There is no way to know, from the API, whether the patron will be notified about the waiting hold and through which method ("Patron is not notified." / "Main contact method:" in returns.pl), because the patron's messaging preferences are not exposed. This bug adds a permission-gated notification summary to the patron as exposed through the checkin embeds, so consumers (starting with the Vue checkin page) can display the same information the legacy page does without leaking patron data. Test plan: 1. Have a waiting-hold-on-checkin scenario for a patron 2. As a user who can see the patron, GET the checkin availability / POST the checkin with the hold.patron embed => SUCCESS: the response includes the patron notification summary 3. As a user who cannot see patrons from that library (view_borrower_infos_from_any_libraries not held, ft_hide_patron_info group), repeat => SUCCESS: the patron identity/notification data is redacted 4. Sign off :-D Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42383 [Bug 42383] Migrate check-in page to Vue -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 --- Comment #1 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 208549 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208549&action=edit Bug 43486: Add permission-gated notification_summary patron embed Adds a `notification_summary` embed to the patron API, exposing how the patron will be notified: { hold_fill_notified => 0|1, primary_contact_method => 'email' } This is patron information, so it must not leak to consumers that are not allowed to see the patron. The generic embed machinery computes embeds via a bare accessor ($patron->notification_summary) with no requesting-user context and cannot enforce that gate itself, and the parent redaction in to_api runs before embeds are attached. So Koha::Patron->to_api strips the notification_summary out after the fact when the requesting user is not allowed to see the patron (is_accessible / can_see_patron_infos). This unblocks the Vue checkin page (bug 42383), which needs to display the "is notified" / "main contact method" information the legacy returns.pl dialog shows, without leaking patron data. Test plan: 1. Apply patch 2. Run: $ ktd --shell k$ prove t/db_dependent/Koha/Patrons.t t/db_dependent/api/v1/patrons.t => SUCCESS: Tests pass, including the gating subtest 3. GET /patrons/:id?x-koha-embed=notification_summary as a user who can see the patron => SUCCESS: response includes notification_summary 4. Repeat as a user who cannot see the patron (no view_borrower_infos_from_any_libraries, ft_hide_patron_info group) => SUCCESS: notification_summary is absent 5. Sign off :-D Assisted-by: Sonnet 4.6 (Anthropic) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 --- Comment #2 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 208550 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208550&action=edit Bug 43486: (follow-up) Report notice transports in notification_summary The notification_summary embed only exposed a boolean hold_fill_notified. The checkin/returns confirmation UIs show which transports the patron uses for the relevant notice. Add per-notice transport lists so consumers can render the same detail as the legacy returns page: - hold_fill_transports / hold_fill_notified (Hold_Filled) - recall_waiting_transports / recall_waiting_notified (Recall_Waiting) Test plan: 1. prove t/db_dependent/Koha/Patrons.t => SUCCESS: notification_summary subtest passes, including the new hold_fill_transports and recall_waiting_transports assertions 2. Sign off :-D Assisted-by: Sonnet 4.6 (Anthropic) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |tomascohen@gmail.com |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrew@bywatersolutions.com QA Contact|tomascohen@gmail.com |testopia@bugs.koha-communit | |y.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #208549|0 |1 is obsolete| | Attachment #208550|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 --- Comment #3 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- Created attachment 208636 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208636&action=edit Bug 43486: Add permission-gated notification_summary patron embed Adds a `notification_summary` embed to the patron API, exposing how the patron will be notified: { hold_fill_notified => 0|1, primary_contact_method => 'email' } This is patron information, so it must not leak to consumers that are not allowed to see the patron. The generic embed machinery computes embeds via a bare accessor ($patron->notification_summary) with no requesting-user context and cannot enforce that gate itself, and the parent redaction in to_api runs before embeds are attached. So Koha::Patron->to_api strips the notification_summary out after the fact when the requesting user is not allowed to see the patron (is_accessible / can_see_patron_infos). This unblocks the Vue checkin page (bug 42383), which needs to display the "is notified" / "main contact method" information the legacy returns.pl dialog shows, without leaking patron data. Test plan: 1. Apply patch 2. Run: $ ktd --shell k$ prove t/db_dependent/Koha/Patrons.t t/db_dependent/api/v1/patrons.t => SUCCESS: Tests pass, including the gating subtest 3. GET /patrons/:id?x-koha-embed=notification_summary as a user who can see the patron => SUCCESS: response includes notification_summary 4. Repeat as a user who cannot see the patron (no view_borrower_infos_from_any_libraries, ft_hide_patron_info group) => SUCCESS: notification_summary is absent 5. Sign off :-D Assisted-by: Sonnet 4.6 (Anthropic) Signed-off-by: Anna Stalter <staltera@hamiltoneastpl.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 --- Comment #4 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- Created attachment 208637 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208637&action=edit Bug 43486: (follow-up) Report notice transports in notification_summary The notification_summary embed only exposed a boolean hold_fill_notified. The checkin/returns confirmation UIs show which transports the patron uses for the relevant notice. Add per-notice transport lists so consumers can render the same detail as the legacy returns page: - hold_fill_transports / hold_fill_notified (Hold_Filled) - recall_waiting_transports / recall_waiting_notified (Recall_Waiting) Test plan: 1. prove t/db_dependent/Koha/Patrons.t => SUCCESS: notification_summary subtest passes, including the new hold_fill_transports and recall_waiting_transports assertions 2. Sign off :-D Assisted-by: Sonnet 4.6 (Anthropic) Signed-off-by: Anna Stalter <staltera@hamiltoneastpl.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |ASSIGNED CC| |blawlor@clamsnet.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 --- Comment #5 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Rebased on top of main now that bug 42418 is pushed. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #208636|0 |1 is obsolete| | Attachment #208637|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 --- Comment #6 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 209550 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209550&action=edit Bug 43486: Add permission-gated notification_summary patron embed Adds a `notification_summary` embed to the patron API, exposing how the patron will be notified: { hold_fill_notified => 0|1, primary_contact_method => 'email' } This is patron information, so it must not leak to consumers that are not allowed to see the patron. The generic embed machinery computes embeds via a bare accessor ($patron->notification_summary) with no requesting-user context and cannot enforce that gate itself, and the parent redaction in to_api runs before embeds are attached. So Koha::Patron->to_api strips the notification_summary out after the fact when the requesting user is not allowed to see the patron (is_accessible / can_see_patron_infos). This unblocks the Vue checkin page (bug 42383), which needs to display the "is notified" / "main contact method" information the legacy returns.pl dialog shows, without leaking patron data. Test plan: 1. Apply patch 2. Run: $ ktd --shell k$ prove t/db_dependent/Koha/Patrons.t t/db_dependent/api/v1/patrons.t => SUCCESS: Tests pass, including the gating subtest 3. GET /patrons/:id?x-koha-embed=notification_summary as a user who can see the patron => SUCCESS: response includes notification_summary 4. Repeat as a user who cannot see the patron (no view_borrower_infos_from_any_libraries, ft_hide_patron_info group) => SUCCESS: notification_summary is absent 5. Sign off :-D Assisted-by: Sonnet 4.6 (Anthropic) Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 --- Comment #7 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 209551 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209551&action=edit Bug 43486: (follow-up) Report notice transports in notification_summary The notification_summary embed only exposed a boolean hold_fill_notified. The checkin/returns confirmation UIs show which transports the patron uses for the relevant notice. Add per-notice transport lists so consumers can render the same detail as the legacy returns page: - hold_fill_transports / hold_fill_notified (Hold_Filled) - recall_waiting_transports / recall_waiting_notified (Recall_Waiting) Test plan: 1. prove t/db_dependent/Koha/Patrons.t => SUCCESS: notification_summary subtest passes, including the new hold_fill_transports and recall_waiting_transports assertions 2. Sign off :-D Assisted-by: Sonnet 4.6 (Anthropic) Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 --- Comment #8 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Follow-up needed for the Cypress tasks that create patrons (insertSamplePatron, insertSampleHold, insertSampleCheckout): the random notification_summary string was rejected by POST /patrons. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43486 --- Comment #9 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 209602 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209602&action=edit Bug 43486: (follow-up) Do not send notification_summary for sample patrons The notification_summary attribute added to the patron definition is generated by buildSampleObject as a random string, which makes the insertSamplePatron Cypress task (and all the tasks using it, like insertSampleHold and insertSampleCheckout) fail with: Error: Expected object/null - got string. This patch strips the attribute before POSTing the patron, like it is already done for the other read-only/embeddable attributes. Test plan: 1. Run: $ ktd --shell k$ yarn cypress run --spec t/cypress/integration/Circulation/FineNoRenewals_spec.ts => FAIL: insertSampleCheckout fails with 'Expected object/null - got string' 2. Apply this patch 3. Repeat 1 => SUCCESS: Tests pass! 4. Sign off :-D Assisted-by: Opus 5.5 (Anthropic) -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org