[Bug 30780] New: Librarians with only "place_holds" permissions can not update holds data via REST API
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 Bug ID: 30780 Summary: Librarians with only "place_holds" permissions can not update holds data via REST API Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs@lists.koha-community.org Reporter: johanna.raisa@koha-suomi.fi CC: tomascohen@gmail.com Cancel hold, suspend the hold and resume the hold endpoints have too high permissions for librarians with only "place_holds" permissions. As this was changed in the views, then the change should be added to the REST API also. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 Johanna Räisä <johanna.raisa@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff Assignee|koha-bugs@lists.koha-commun |johanna.raisa@koha-suomi.fi |ity.org | --- Comment #1 from Johanna Räisä <johanna.raisa@koha-suomi.fi> --- Created attachment 135052 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=135052&action=edit Bug 30780: Librarians with only "place_holds" permissions can not update holds data via REST API This patch enables librarians with only "place_holds" permissions to cancel, suspend and resume holds via REST API. Test plan: 1) Try to cancel or suspend a hold with only "place_holds" permissions 2) See that it is forbidden. 3) Apply the patch 4) Cancel a hold again 5) The cancellation succeeds 6) prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 Johanna Räisä <johanna.raisa@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Change sponsored?|--- |Sponsored See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=30207 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 --- Comment #2 from David Nind <david@davidnind.com> --- Created attachment 135080 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=135080&action=edit Bug 30780: Librarians with only "place_holds" permissions can not update holds data via REST API This patch enables librarians with only "place_holds" permissions to cancel, suspend and resume holds via REST API. Test plan: 1) Try to cancel or suspend a hold with only "place_holds" permissions 2) See that it is forbidden. 3) Apply the patch 4) Cancel a hold again 5) The cancellation succeeds 6) prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com --- Comment #3 from David Nind <david@davidnind.com> --- Testing notes using koha-testing-docker: 1. I used the Firefox addon RESTr to test. 2. Place two holds in the staff interface. 3. Change the username and password for a staff patron. 4. List the holds using the REST API and note down the hold_ids: - Method: GET - URL: http://127.0.0.1/8080/api/v1/holds/ - Authentication: use koha + koha for basic authentication (or give the staff patron used Add, modify and view patron information (borrowers) access so they can view the list of holds) 5. Suspend a hold (where {hold_id} is one of the holds listed in step 3 and YYYY-MM-DD is a future date): - Method: POST - URL: http://127.0.0.1:8080/api/v1/holds/{hold_id}/suspension - Authentication: staff patron with place_holds permission - Body (JSON): { "end_date": "YYYY-MM-DD" } 6. Cancel a hold (where {hold_id} is one of the holds listed in step 3): - Method: DELETE - URL: http://127.0.0.1:8080/api/v1/holds/{hold_id} - Authentication: staff patron with place_holds permission -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |victor@tuxayo.net Attachment #135052|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|victor@tuxayo.net | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com QA Contact| |kyle@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #135080|0 |1 is obsolete| | --- Comment #4 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 135946 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=135946&action=edit Bug 30780: Librarians with only "place_holds" permissions can not update holds data via REST API This patch enables librarians with only "place_holds" permissions to cancel, suspend and resume holds via REST API. Test plan: 1) Try to cancel or suspend a hold with only "place_holds" permissions 2) See that it is forbidden. 3) Apply the patch 4) Cancel a hold again 5) The cancellation succeeds 6) prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 --- Comment #5 from Kyle M Hall <kyle@bywatersolutions.com> --- QA Notes: none of the affected APIs modifies priority, so this seems reasonable. Would be nice to see unit tests to prove the minimum user permissions needed work. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This enhancement enables release notes| |librarians with only | |"place_holds" permissions | |to cancel, suspend and | |resume holds using the REST | |API. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #135946|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |normal -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 --- Comment #6 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 136031 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=136031&action=edit Bug 30780: Regression tests This patch lowers the used permissions on the suspend/resume tests, and adds tests for fine-grained permissions on cancelling a hold. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 --- Comment #7 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 136032 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=136032&action=edit Bug 30780: Librarians with only "place_holds" permissions can not update holds data via REST API This patch enables librarians with only "place_holds" permissions to cancel, suspend and resume holds via REST API. Test plan: 1) Try to cancel or suspend a hold with only "place_holds" permissions 2) See that it is forbidden. 3) Apply the patch 4) Cancel a hold again 5) The cancellation succeeds 6) prove t/db_dependent/api/v1/holds.t Sponsored-by: Koha-Suomi Oy Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 --- Comment #8 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Kyle M Hall from comment #5)
Would be nice to see unit tests to prove the minimum user permissions needed work.
Good catch, done. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |22.11.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 --- Comment #9 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Pushed to master for 22.11. Nice work everyone, thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30780 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Version(s)|22.11.00 |22.11.00, 22.05.03 released in| | Status|Pushed to master |Pushed to stable --- Comment #10 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 22.05.x for 22.05.03 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org