Bug 24157: New permission - reopen_closed_invoices

New permission to reopen a closed invoice.

Test plan:
- Remove the new permission "reopen_closed_invoices" for a given patron,
use it to log in into Koha
- Create an invoice, close it
=> You are not able to reopen the invoice
- Add the permission
=> You are able to reopen the invoice

Sponsored-by: Galway-Mayo Institute of Technology

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

acqui/invoice.pl

@@ -52,6 +52,8 @@ my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user(
     }
 );
 
+my $logged_in_patron = Koha::Patrons->find( $loggedinuser );
+
 my $invoiceid = $input->param('invoiceid');
 my $op        = $input->param('op');
 
@@ -70,6 +72,9 @@ if ( $op && $op eq 'close' ) {
     }
 }
 elsif ( $op && $op eq 'reopen' ) {
+    output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
+        unless $logged_in_patron->has_permission( { acquisition => 'reopen_closed_invoices' } );
+
     ReopenInvoice($invoiceid);
     my $referer = $input->param('referer');
     if ($referer) {
@@ -90,7 +95,8 @@ elsif ( $op && $op eq 'mod' ) {
         shipmentcost_budgetid => $shipment_budget_id
     );
     if ($input->param('reopen')) {
-        ReopenInvoice($invoiceid);
+        ReopenInvoice($invoiceid)
+            if $logged_in_patron->has_permission( { acquisition => 'reopen_closed_invoices' } );
     } elsif ($input->param('close')) {
         CloseInvoice($invoiceid);
     } elsif ($input->param('merge')) {

installer/data/mysql/atomicupdate/bug_24157.perl

@@ -0,0 +1,10 @@
+$DBversion = 'XXX'; # will be replaced by the RM
+if( CheckVersion( $DBversion ) ) {
+    $dbh->do(q|
+        INSERT IGNORE INTO permissions (module_bit, code, description) VALUES
+        (11, 'reopen_closed_invoices', 'Reopen closed invoices')
+    |);
+
+    SetVersion( $DBversion );
+    print "Upgrade to $DBversion done (Bug 24157: Add new permission reopen_closed_invoices)\n";
+}

installer/data/mysql/userpermissions.sql

@@ -65,6 +65,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
    (11, 'budget_add_del', 'Add and delete funds (but can''t modify funds)'),
    (11, 'budget_manage_all', 'Manage all funds'),
    (11, 'edi_manage', 'Manage EDIFACT transmissions'),
+   (11, 'reopen_closed_invoices', 'Reopen closed invoices'),
    (12, 'suggestions_manage', 'Manage purchase suggestions'),
    (13, 'edit_news', 'Write news for the OPAC and staff interfaces'),
    (13, 'label_creator', 'Create printable labels and barcodes from catalog and patron data'),

koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc

@@ -19,6 +19,8 @@
         <div class="dialog message">The budget is locked, fund creation is not possible.</div>
     [% CASE 'missing_es_modules' %]
         <div class="dialog message">Necessary Elasticsearch packages are not installed on your server. Please contact your server admin if you wish to configure Elasticsearch</div>
+    [% CASE 'insufficient_permission' %]
+        <div class="dialog message">You do not have sufficient permission to continue.</div>
     [% CASE %][% blocking_error | html %]
     [% END %]
 

koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc

@@ -690,6 +690,11 @@
             Manage EDIFACT transmissions
         </span>
         <span class="permissioncode">([% name | html %])</span>
+    [%- CASE 'reopen_closed_invoices' -%]
+        <span class="sub_permission reopen_closed_invoices_subpermission">
+            Reopen closed invoices
+        </span>
+        <span class="permissioncode">([% name | html %])</span>
   [%# self_check %]
     [%- CASE 'self_checkin_module' -%]
         <span class="sub_permission self_checkin_module_subpermission">

koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt

@@ -15,6 +15,8 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
+[% SET readonly = NOT CAN_user_acquisition_edit_invoices %]
+
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/invoices.pl">Invoices</a> &rsaquo; <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoiceid | html %]">[% invoicenumber | html %]</a></div>
 
 <div class="main container-fluid">
@@ -35,8 +37,12 @@
             <ol>
             <li>
                 <label for="shipmentdate" class="required">Invoice number:</label>
-                <input type="text" id="invoicenumber" name="invoicenumber" value="[% invoicenumber | html %]" class="required" required="required"/>
-                <span class="required">Required</span>
+                [% IF readonly %]
+                    [% invoicenumber | html %]
+                [% ELSE %]
+                    <input type="text" id="invoicenumber" name="invoicenumber" value="[% invoicenumber | html %]" class="required" required="required"/>
+                    <span class="required">Required</span>
+                [% END %]
             </li>
 
             <li><label for="shipmentdate">Shipment date:</label>
@@ -71,7 +77,14 @@
             <li><span class="label">Status:</span>
                 Closed on [% invoiceclosedate | $KohaDates %]</li>
 
-            <li><label for="reopen">Reopen: </label> <input type="checkbox" name="reopen" id="reopen" /></li>
+            <li>
+                <label for="reopen">Reopen: </label>
+                [% IF CAN_user_acquisition_reopen_closed_invoices %]
+                    <input type="checkbox" name="reopen" id="reopen" />
+                [% ELSE %]
+                    <input type="checkbox" name="reopen" id="reopen" readonly="readonly" />
+                [% END %]
+            </li>
             [% ELSE %]
             <li><span class="label">Status:</span>
                 Open</li>

koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt

@@ -81,7 +81,9 @@
                           <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="invoiceactions[% invoice.invoiceid | html %]">
                               <li><a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoice.invoiceid | uri %]"><i class="fa fa-search"></i> Details</a></li>
                             [% IF invoice.closedate %]
-                                <li><a href="invoice.pl?op=reopen&amp;invoiceid=[% invoice.invoiceid | uri %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber | uri %]%26supplier=[% booksellerid | uri %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn | uri %]%26title=[% title | uri %]%26author=[% author | uri %]%26publisher=[% publisher | uri %]%26publicationyear=[% publicationyear | uri %]%26branch=[% branch | uri %]"><i class="fa fa-refresh"></i> Reopen</a></li>
+                                [% IF CAN_user_acquisition_reopen_closed_invoices %]
+                                    <li><a href="invoice.pl?op=reopen&amp;invoiceid=[% invoice.invoiceid | uri %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber | uri %]%26supplier=[% booksellerid | uri %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn | uri %]%26title=[% title | uri %]%26author=[% author | uri %]%26publisher=[% publisher | uri %]%26publicationyear=[% publicationyear | uri %]%26branch=[% branch | uri %]"><i class="fa fa-refresh"></i> Reopen</a></li>
+                                [% END %]
                             [% ELSE %]
                                 <li><a href="invoice.pl?op=close&amp;invoiceid=[% invoice.invoiceid | uri %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber | uri %]%26supplier=[% booksellerid | uri %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn | uri %]%26title=[% title | uri %]%26author=[% author | uri %]%26publisher=[% publisher | uri %]%26publicationyear=[% publicationyear | uri %]%26branch=[% branch | uri %]"><i class="fa fa-times-circle"></i> Close</a></li>
                             [% END %]

koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt

@@ -213,7 +213,9 @@
 [% ELSE %]
     <p>
         Invoice is closed, so you can't receive orders anymore.
-        <a href="/cgi-bin/koha/acqui/invoice.pl?op=reopen&invoiceid=[% invoiceid | uri %]&referer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid | uri %]">Reopen it</a>.
+        [% IF CAN_user_acquisition_reopen_closed_invoices %]
+            <a href="/cgi-bin/koha/acqui/invoice.pl?op=reopen&invoiceid=[% invoiceid | uri %]&referer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid | uri %]">Reopen it</a>.
+        [% END %]
     </p>
 [% END %]