https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43602
--- Comment #2 from Martin Renvoize (ashimema) <[email protected]> --- Created attachment 206596 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=206596&action=edit Bug 43602: Add GET /api/v1/article_requests/{article_request_id} and public_read_list Adds the single-resource read action alongside the existing list action, using the same objects.to_api helper, and a _find($c) helper that looks requests up via Koha::ArticleRequests->search_limited so both actions honor the same branch-visibility restriction (a staff user without borrowers: view_borrower_infos_from_any_libraries can only see requests from patrons in libraries they're allowed to see). Also adds public_read_list to Koha::ArticleRequest, needed so a later public-facing endpoint can safely return the article request representation to the patron without leaking the internal debit_id accounting reference. Koha::Object::to_api filters public_read_list BEFORE renaming columns via to_api_mapping, so the list is expressed in DB column names (id, borrowernumber, biblionumber, itemnumber, branchcode, ...), not their API-facing equivalents - getting this wrong would silently drop patron_id/biblio_id/article_request_id/item_id/ library_id from every public response, since Koha::Object::TO_JSON hasn't renamed anything yet at the point the filter runs. Covered by a behavioral test that builds a real article request and asserts the actual keys present in to_api({public => 1}) output, rather than just checking the method's return value against a copy of itself. Co-Authored-By: Claude Sonnet 5 <[email protected]> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
