https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42916
--- Comment #20 from David Nind <[email protected]> --- Created attachment 205662 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=205662&action=edit Bug 42916: Allow modifying holds with place_holds, keep priority gated Modifying a hold via PATCH /holds/{hold_id} required the top-level reserveforothers permission, so staff with only place_holds could no longer edit a hold's expiration date. This is a regression. This patch lowers the operation-level permission to place_holds and uses the attribute-level permissions framework to keep the priority attribute gated behind reserveforothers/modify_holds_priority. Expiration date, pickup location and suspension can now be changed with place_holds, while changing the priority still requires modify_holds_priority. The deprecated PUT /holds/{hold_id} (full replacement) is intentionally left untouched. Changes: - Lower PATCH /holds/{hold_id} authorization to reserveforothers/place_holds - Annotate the priority attribute with x-mod-permissions (reserveforothers/modify_holds_priority) Test plan: 1. Create a staff user with place_holds but not modify_holds_priority 2. Place a hold 3. From reserve/request.pl?biblionumber=X try to edit the expiration date => FAIL: the date disappears and is not updated 4. Apply this patch, yarn build, restart_all 5. Repeat step 3 => SUCCESS: the expiration date is updated 6. Try to change the priority as that same user => SUCCESS: rejected with 403 (needs modify_holds_priority) 7. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/holds.t => SUCCESS: Tests pass! 8. Sign off :-D Assisted-by: Sonnet 4.6 (Anthropic) Signed-off-by: David Nind <[email protected]> -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
