From b02e6c780b83b8c7f7cb89087920a8bd7a09c016 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 17 Oct 2025 05:46:13 +0200
Subject: [PATCH] Bug 38414: Fix permission controller-side

This bug refactors the preview sql buttons to pass the permissions granted for each report to
the javascript that clones and updates the modal.

That allows us to check for the appropriate permissions when preparing the buttons for the modal
and to remove any that are not allowed.

This allows for different permissions per report for future devs
(see bugs 42406, 16631)

To test:
1. Create some reports
2. Create a user with only execute_reports permissions
3. Login as that user and go to Reports > use saved
4. In the actions column click the ^ and select 'Preview sql'
5. Notice delete button renders and works to delete
6. Apply patch and restart_all
7. Repeat step 4, now only the Run report button renders and works
8. Add permissions for create_reports
9. Repeat step for, now Edit, Duplicate, Schedule and run buttons render and work
10. Add permissions for delete_reports
11. Repeat step 4, confirm the delete button renders and works
12. Confirm the preview sql button works to preview different reports

We also fix some error in the script, several wrong things there:
* delete was not replaced with cud-delete
* missing op for the creation of new reports
* update and run requires two permssions

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Scott Barter <sbarter@aacpl.net>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 .../prog/en/modules/reports/guided_reports_start.tt | 11 ++++++++++-
 reports/guided_reports.pl                           | 13 ++++++++-----
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
index 7c493d8020..af9074b34f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
@@ -388,7 +388,16 @@
                                                                         ></li
                                                                     >
                                                                     <li>
-                                                                        <a href="/cgi-bin/koha/reports/guided_reports.pl?id=[% savedreport.id | uri %]&op=show" class="dropdown-item preview_sql" data-reportid="[% savedreport.id | html %]">
+                                                                        <a
+                                                                            [% # tags below to remove extra whitespace added for readability %]
+                                                                            [%- " "|$raw -%]href="/cgi-bin/koha/reports/guided_reports.pl?id=[% savedreport.id | uri %]&op=show"
+                                                                            [%- " "|$raw -%]class="dropdown-item preview_sql"
+                                                                            [%- " "|$raw -%]data-reportid="[% savedreport.id | html %]"
+                                                                            [%- " "|$raw -%]data-create="[% CAN_user_reports_create_reports || 0 | html %]"
+                                                                            [%- " "|$raw -%]data-delete="[% CAN_user_reports_delete_reports || 0 | html %]"
+                                                                            [%- " "|$raw -%]data-run="[% CAN_user_reports_execute_reports || 0 | html %]"
+                                                                            [%- ""|$raw -%]
+                                                                        >
                                                                             <i class="fa-solid fa-eye" aria-hidden="true"></i> Preview SQL
                                                                         </a>
                                                                     </li>
diff --git a/reports/guided_reports.pl b/reports/guided_reports.pl
index d1444a7c6e..065b31027f 100755
--- a/reports/guided_reports.pl
+++ b/reports/guided_reports.pl
@@ -58,15 +58,18 @@ my $usecache = Koha::Caches->get_instance->memcached_cache;
 
 my $op = $input->param('op') // '';
 my $flagsrequired;
-if (   ( $op eq 'add_form' )
-    || ( $op eq 'add_form_sql' )
-    || ( $op eq 'edit_form' )
-    || ( $op eq 'duplicate' ) )
+if (   $op eq 'add_form'
+    || $op eq 'add_form_sql'
+    || $op eq 'edit_form'
+    || $op eq 'duplicate'
+    || $op eq 'cud-save'
+    || $op eq 'cud-update_sql'
+    || $op eq 'cud-update_and_run_sql' )
 {
     $flagsrequired = 'create_reports';
 } elsif ( $op eq 'list' ) {
     $flagsrequired = 'execute_reports';
-} elsif ( $op eq 'delete' ) {
+} elsif ( $op eq 'cud-delete' ) {
     $flagsrequired = 'delete_reports';
 } else {
     $flagsrequired = '*';