[Bug 38930] New: Add a permissions store for Vue apps
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Bug ID: 38930 Summary: Add a permissions store for Vue apps Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: ERM Assignee: jonathan.druart@gmail.com Reporter: matt.blenkinsop@ptfs-europe.com QA Contact: testopia@bugs.koha-community.org CC: jonathan.druart@gmail.com, jonathan.field@ptfs-europe.com, martin.renvoize@ptfs-europe.com, matt.blenkinsop@ptfs-europe.com, pedro.amorim@ptfs-europe.com We need to be able to handle permissions within Vue apps to do things like hiding action buttons or menu options -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|jonathan.druart@gmail.com |matt.blenkinsop@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |37930 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37930 [Bug 37930] Change how we handle authorised values in Vue -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 --- Comment #1 from Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> --- Created attachment 176826 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=176826&action=edit Bug 38930: Add API endpoint This patch adds an API endpoint to return a hash of a user's permissions -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 --- Comment #2 from Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> --- Created attachment 176827 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=176827&action=edit Bug 38930: Add a permissions store This patch adds a permissions store to hold a user's permissions and run checks when required Test plan: 1) Apply the patch and run the following commands a) yarn build b) restart_all 2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements 3) Note that the button for New Agreement is visible 4) Choose a random staff user and assign them the following permissions: - Staff access, allows viewing of the catalogue in staff interface (catalogue) - Manage Koha system settings (Administration panel) (parameters) - Acquisition management (acquisition) - Manage the electronic resources module (erm) These are the permissions required to access the ERM module 6) Open an incognito browser and log in as the chosen staff member with these permissions 7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work 8) Navigate to the Agreements page again, the button should not be visible 9) Back in your main browser, assign the following permission set to the user: - Create purchase suggestions (suggestions_create) 10) Hard refresh the incognito browser, the button should now be visible again -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 --- Comment #3 from Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> --- Created attachment 176828 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=176828&action=edit Bug 38930: (DO NOT PUSH) Add an example to ERM -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #4 from David Cook <dcook@prosentient.com.au> --- I found the title a bit scary at first, but the patches make sense. No point showing options that users aren't authorized to do. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com Status|Needs Signoff |In Discussion --- Comment #5 from Jonathan Druart <jonathan.druart@gmail.com> --- This looks good. Some remarks however: 1. Missing tests (at least for the new REST API endpoint, but it would be good to have some Cypress tests) 2. (wording) Wondering if "isUserPermitted" should not be closed to what we have in the module: has_permissions. What do you think? 3. About the endpoint, you named it /user_permissions There is a comment in the code: Koha/Patron.pm: flags => undef, # permissions manipulation handled in /permissions And in Koha/REST/V1/ERM.pm: 40 sub config { 49 # TODO Add permissions There are contradicting one another, but we discussed that when we implemented /erm/config and we agreed to have the logged in user's info embedded in this route. I think we should discuss 3. with Tomas. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |38941 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38941 [Bug 38941] Convert the acquisitions menu to a Vue island -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #176826|0 |1 is obsolete| | --- Comment #6 from Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> --- Created attachment 178245 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=178245&action=edit Bug 38930: Add API endpoint This patch adds an API endpoint to return a hash of a user's permissions -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #176827|0 |1 is obsolete| | --- Comment #7 from Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> --- Created attachment 178246 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=178246&action=edit Bug 38930: Add a permissions store This patch adds a permissions store to hold a user's permissions and run checks when required Test plan: 1) Apply the patch and run the following commands a) yarn build b) restart_all 2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements 3) Note that the button for New Agreement is visible 4) Choose a random staff user and assign them the following permissions: - Staff access, allows viewing of the catalogue in staff interface (catalogue) - Manage Koha system settings (Administration panel) (parameters) - Acquisition management (acquisition) - Manage the electronic resources module (erm) These are the permissions required to access the ERM module 6) Open an incognito browser and log in as the chosen staff member with these permissions 7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work 8) Navigate to the Agreements page again, the button should not be visible 9) Back in your main browser, assign the following permission set to the user: - Create purchase suggestions (suggestions_create) 10) Hard refresh the incognito browser, the button should now be visible again -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #176828|0 |1 is obsolete| | --- Comment #8 from Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> --- Created attachment 178247 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=178247&action=edit Bug 38930: (DO NOT PUSH) Add an example to ERM -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Amaury GAU <amaury.gau@bulac.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |amaury.gau@bulac.fr -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|In Discussion |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #178245|0 |1 is obsolete| | Attachment #178246|0 |1 is obsolete| | Attachment #178247|0 |1 is obsolete| | --- Comment #9 from Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> --- Created attachment 181365 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181365&action=edit Bug 38930: Add a permissions store This patch adds a permissions store to hold a user's permissions and run checks when required Test plan: 1) Apply the patch and run the following commands a) yarn build b) restart_all 2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements 3) Note that the button for New Agreement is visible 4) Choose a random staff user and assign them the following permissions: - Staff access, allows viewing of the catalogue in staff interface (catalogue) - Manage Koha system settings (Administration panel) (parameters) - Acquisition management (acquisition) - Manage the electronic resources module (erm) These are the permissions required to access the ERM module 6) Open an incognito browser and log in as the chosen staff member with these permissions 7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work 8) Navigate to the Agreements page again, the button should not be visible 9) Back in your main browser, assign the following permission set to the user: - Create purchase suggestions (suggestions_create) 10) Hard refresh the incognito browser, the button should now be visible again -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 --- Comment #10 from Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> --- Created attachment 181366 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181366&action=edit Bug 38930: (DO NOT PUSH) Add an example to ERM -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181366|0 |1 is obsolete| | --- Comment #11 from Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> --- Created attachment 181609 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181609&action=edit Bug 38930: (DO NOT PUSH) Add an example to ERM -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Biblibre Sandboxes <sandboxes@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181609|0 |1 is obsolete| | --- Comment #12 from Biblibre Sandboxes <sandboxes@biblibre.com> --- Created attachment 181622 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181622&action=edit Bug 38930: (DO NOT PUSH) Add an example to ERM Signed-off-by: Michaela <michaela.sieber@kit.edu> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Biblibre Sandboxes <sandboxes@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181365|0 |1 is obsolete| | --- Comment #13 from Biblibre Sandboxes <sandboxes@biblibre.com> --- Created attachment 181624 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181624&action=edit Bug 38930: Add a permissions store This patch adds a permissions store to hold a user's permissions and run checks when required Test plan: 1) Apply the patch and run the following commands a) yarn build b) restart_all 2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements 3) Note that the button for New Agreement is visible 4) Choose a random staff user and assign them the following permissions: - Staff access, allows viewing of the catalogue in staff interface (catalogue) - Manage Koha system settings (Administration panel) (parameters) - Acquisition management (acquisition) - Manage the electronic resources module (erm) These are the permissions required to access the ERM module 6) Open an incognito browser and log in as the chosen staff member with these permissions 7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work 8) Navigate to the Agreements page again, the button should not be visible 9) Back in your main browser, assign the following permission set to the user: - Create purchase suggestions (suggestions_create) 10) Hard refresh the incognito browser, the button should now be visible again Signed-off-by: Michaela <michaela.sieber@kit.edu> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Biblibre Sandboxes <sandboxes@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181622|0 |1 is obsolete| | --- Comment #14 from Biblibre Sandboxes <sandboxes@biblibre.com> --- Created attachment 181625 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181625&action=edit Bug 38930: (DO NOT PUSH) Add an example to ERM Signed-off-by: Michaela <michaela.sieber@kit.edu> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Michaela Sieber <michaela.sieber@kit.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |michaela.sieber@kit.edu -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=39785 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181624|0 |1 is obsolete| | --- Comment #15 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 181722 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181722&action=edit Bug 38930: Add a permissions store This patch adds a permissions store to hold a user's permissions and run checks when required Test plan: 1) Apply the patch and run the following commands a) yarn build b) restart_all 2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements 3) Note that the button for New Agreement is visible 4) Choose a random staff user and assign them the following permissions: - Staff access, allows viewing of the catalogue in staff interface (catalogue) - Manage Koha system settings (Administration panel) (parameters) - Acquisition management (acquisition) - Manage the electronic resources module (erm) These are the permissions required to access the ERM module 6) Open an incognito browser and log in as the chosen staff member with these permissions 7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work 8) Navigate to the Agreements page again, the button should not be visible 9) Back in your main browser, assign the following permission set to the user: - Create purchase suggestions (suggestions_create) 10) Hard refresh the incognito browser, the button should now be visible again -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181722|0 |1 is obsolete| | --- Comment #16 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 181723 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181723&action=edit Bug 38930: Add a permissions store This patch adds a permissions store to hold a user's permissions and run checks when required Test plan: 1) Apply the patch and run the following commands a) yarn build b) restart_all 2) Ensuring you are logged in as the Koha superlibrarian user, navigate to the ERM module and click into Agreements 3) Note that the button for New Agreement is visible 4) Choose a random staff user and assign them the following permissions: - Staff access, allows viewing of the catalogue in staff interface (catalogue) - Manage Koha system settings (Administration panel) (parameters) - Acquisition management (acquisition) - Manage the electronic resources module (erm) These are the permissions required to access the ERM module 6) Open an incognito browser and log in as the chosen staff member with these permissions 7) For this example, the New agreement button has been hidden behind the CAN_user_suggestions_suggestions_create to demonstrate how it would work 8) Navigate to the Agreements page again, the button should not be visible 9) Back in your main browser, assign the following permission set to the user: - Create purchase suggestions (suggestions_create) 10) Hard refresh the incognito browser, the button should now be visible again Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |jonathan.druart@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |release-notes-needed -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 --- Comment #17 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I think having some notes somewhere for devs might be helfpul? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |25.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 --- Comment #18 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 25.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|ERM |Architecture, internals, | |and plumbing -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Status|Pushed to main |Needs documenting --- Comment #19 from Fridolin Somers <fridolin.somers@biblibre.com> --- Enhancement not pushed to 24.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED CC| |david@davidnind.com Status|Needs documenting |RESOLVED --- Comment #20 from David Nind <david@davidnind.com> --- No changes to the manual required. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Bug 38930 depends on bug 37930, which changed state. Bug 37930 Summary: Change how we handle authorised values in Vue https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37930 What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38930 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|release-notes-needed | -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org