https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41869 Johanna Räisä <johanna.raisa@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff Assignee|koha-bugs@lists.koha-commun |johanna.raisa@koha-suomi.fi |ity.org | --- Comment #1 from Johanna Räisä <johanna.raisa@koha-suomi.fi> --- Created attachment 193339 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193339&action=edit Bug 41869: Change place_holds permission to /holds POST and PATCH This patch changes the place_holds permission to be required for POST and PATCH requests to /holds. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41869 Johanna Räisä <johanna.raisa@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=23269 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41869 Johanna Räisä <johanna.raisa@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193339|0 |1 is obsolete| | --- Comment #3 from Johanna Räisä <johanna.raisa@koha-suomi.fi> --- Created attachment 193372 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193372&action=edit Bug 41869: Change place_holds permission to /holds POST and PATCH This patch changes the place_holds permission to be required for POST and PATCH requests to /holds. Test plan: 1. Create a patron with the place_holds permission. 2. Try to add (POST) a hold to /holds and verify that it is forbidden. 3. Try to edit (PATCH) a hold to /holds and verify that it is forbidden. 4. Apply the patch and repeat steps 2 and 3, verifying that the requests are now allowed. 5. prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41869 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193372|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41869 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |release-notes-needed --- Comment #5 from David Nind <david@davidnind.com> --- Thanks for the test plan! For a non-developer like myself, steps 2 and 3 are a bit of a mystery 8-) I muddled through, here are my testing notes (using KTD): 1. Edit Henry Acevedo's account so that you can log in as Henry. 2. Set Henry's permissions: - Staff access, allows viewing of catalogue in staff interface (catalogue) - Place and modify holds for patrons (reserveforothers) - Add, modify and view patron information (borrowers) 3. Test placing and modifying a hold using the API, using Henry's credentials (I used Bruno https://www.usebruno.com/) - these should be successful. (I used Mary Burton (patron_id = 49) as the patron and Programming perl (biblio_id = 262) for the record.) 3.1 Place a hold: POST 127.0.0.1:8081/api/v1/holds Auth: Basic Auth with Henry's username and password Body (JSON): { "patron_id": "49", "biblio_id": "262", "pickup_library_id": "CPL" } 3.2 Modify a hold (changes the hold date) (assuming the hold_id = "1"*, adjust as appropriate): PATCH 127.0.0.1:8081/api/v1/holds/1 Auth: Basic Auth with Henry's username and password Body (JSON): { "hold_date": "2026-02-17", "pickup_library_id": "CPL" } * To find the hold_id: - Access the database: koha-mysql kohadev - List the holds: select * from reserves; 4. Delete the hold created for Mary, using the staff interface. 5. Change Henry's permissions: - remove "Move holds between items and records (alter_hold_targets)" permission (leaves "Modify holds priority (modify_holds_priority)" and "Place holds for patrons (place_holds)" selected) 6. Test placing and modifying a hold using the API as per steps 3.1 and 3.2 - should return an error: 403 error returned: { "error": "Authorization failure. Missing required permission(s).", "required_permissions": { "reserveforothers": "1" } } 7. Test placing a hold as Henry using the staff interface - this should be successful! 8. Delete the hold created, using the staff interface. 8. Apply the patch, run yarn build, and restart everything (restart_all). 9. Repeat steps 3.1 and 3.2 - these should now be successful. 10. Repeat step 7 - this should be successful. 11. The tests should pass: prove t/db_dependent/api/v1/holds.t -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41869 Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #6 from Emily Lamancusa (emlam) <emily.lamancusa@montgomerycountymd.gov> --- Thanks for working on this, Johanna! The code for the POST endpoint looks good! However, the PATCH endpoint also allows changing the hold's priority, which has its own permission, so that endpoint should require both place_holds and modify_holds_priority permissions. -- You are receiving this mail because: You are watching all bug changes.