From b760367e252ce59059f18fe4d3fb0bd184190eaa Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Date: Fri, 27 Feb 2026 10:10:51 +0000
Subject: [PATCH] Bug 10190: Fix patron_categories permission format

The x-koha-authorization was using 'parameters: catalogue' which the
Koha auth system interprets as a 'catalogue' subpermission within the
'parameters' module (which doesn't exist), causing a 403 for any user.

The correct format for the top-level 'catalogue' permission is
'catalogue: "1"', consistent with all other read-only API endpoints.

Sponsored-by: Glasgow Colleges Library Group <https://library.cityofglasgowcollege.ac.uk>
Signed-off-by: Michaela <michaela.sieber@kit.edu>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
---
 api/v1/swagger/paths/patron_categories.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/v1/swagger/paths/patron_categories.yaml b/api/v1/swagger/paths/patron_categories.yaml
index 9c4b9a2f50..1cdd2c0dc3 100644
--- a/api/v1/swagger/paths/patron_categories.yaml
+++ b/api/v1/swagger/paths/patron_categories.yaml
@@ -51,7 +51,7 @@
           $ref: "../swagger.yaml#/definitions/error"
     x-koha-authorization:
       permissions:
-        parameters: catalogue
+        catalogue: "1"
   post:
     x-mojo-to: Patrons::Categories#add
     operationId: addCategory