ca098dd521
The ILL Vue app currently reads ILLModule and ILLPartnerCode through the system preferences service. That service requires parameters/manage_sysprefs, so a staff user with ILL permissions but without system preference administration permissions cannot load the ILL module. Add an ILL-specific /ill/config REST endpoint protected by the ill permission, and switch the ILL Vue app to load its configuration from that endpoint. This follows the module-specific configuration endpoint pattern introduced by bug 33606 for the same manage_sysprefs problem in the ERM Vue app. Security/compatibility considerations: the endpoint returns only allow-listed, non-secret ILL configuration values needed by the ILL Vue app. It does not expose the generic system preferences API, and /api/v1/sysprefs remains restricted to parameters/manage_sysprefs. Regression test coverage: the new API test verifies that a staff user with the ill permission can read /ill/config, that a staff user without the ill permission cannot read it, and that the same ILL-only user still cannot access /api/v1/sysprefs. Test plan: 1. prove -I. -It/lib t/db_dependent/api/v1/ill_config.t 2. prove -I. -It/lib t/db_dependent/api/v1/ill_users.t Signed-off-by: David Nind <david@davidnind.com> Amended-by: Jonathan Druart chmod +x t/db_dependent/api/v1/ill_config.t Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> |
||
|---|---|---|
| .. | ||
| v1 | ||
| swagger-v2-schema.json | ||