From 8659f4e016d3e892090ce0e00be04eb95d0a00e1 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Date: Wed, 25 Feb 2026 12:00:46 +0000
Subject: [PATCH] Bug 10190: correction to x-koha-authorization on
 /circulation_rules/config

The config endpoint is used exclusively by the Circulation Triggers
Vue app, which is gated on parameters/manage_circ_rules. Using
acquisition/'*' and erm/1 was inconsistent copy-paste from an
unrelated endpoint and would 403 circ-rules admins while granting
access to unrelated module users.

Signed-off-by: Michaela <michaela.sieber@kit.edu>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
---
 api/v1/swagger/paths/circulation_rules_config.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/api/v1/swagger/paths/circulation_rules_config.yaml b/api/v1/swagger/paths/circulation_rules_config.yaml
index a4624ff811..b6f94e6918 100644
--- a/api/v1/swagger/paths/circulation_rules_config.yaml
+++ b/api/v1/swagger/paths/circulation_rules_config.yaml
@@ -35,5 +35,4 @@
           $ref: "../swagger.yaml#/definitions/error"
     x-koha-authorization:
       permissions:
-        - acquisition: '*'
-        - erm: 1
+        - parameters: manage_circ_rules