Bug 31555: change holds GET permission to place_holds

This patch changes holds' GET REST API endpoint permission
to place_holds to match with request.pl

Test plan:
1) prove t/db_dependent/api/v1/holds.t

Sponsored-by: Koha-Suomi Oy
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

diff --git a/api/v1/swagger/paths/holds.yaml b/api/v1/swagger/paths/holds.yaml
index 617eb3d..7ab45af 100644 (file)
--- a/api/v1/swagger/paths/holds.yaml
+++ b/api/v1/swagger/paths/holds.yaml
@@ -117,7 +117,7 @@
           $ref: "../swagger.yaml#/definitions/error"
     x-koha-authorization:
       permissions:
-        borrowers: edit_borrowers
+        reserveforothers: place_holds
   post:
     x-mojo-to: Holds#add
     operationId: addHold

diff --git a/t/db_dependent/api/v1/holds.t b/t/db_dependent/api/v1/holds.t
index 6665b55..d85f88b 100755 (executable)
--- a/t/db_dependent/api/v1/holds.t
+++ b/t/db_dependent/api/v1/holds.t
@@ -185,7 +185,7 @@ subtest "Test endpoints without permission" => sub {
     $t->get_ok( "//$nopermission_userid:$password@/api/v1/holds?patron_id=" . $patron_1->borrowernumber ) # no permission
       ->status_is(403);
 
-    $t->get_ok( "//$userid_3:$password@/api/v1/holds?patron_id=" . $patron_1->borrowernumber )    # no permission
+    $t->get_ok( "//$userid_2:$password@/api/v1/holds?patron_id=" . $patron_1->borrowernumber )    # no permission
       ->status_is(403);
 
     $t->post_ok( "//$nopermission_userid:$password@/api/v1/holds" => json => $post_data )
@@ -225,7 +225,7 @@ subtest "Test endpoints with permission" => sub {
       ->status_is(404)
       ->json_has('/error');
 
-    $t->get_ok( "//$userid_2:$password@/api/v1/holds?patron_id=" . $patron_1->borrowernumber )
+    $t->get_ok( "//$userid_3:$password@/api/v1/holds?patron_id=" . $patron_1->borrowernumber )
       ->status_is(200)
       ->json_is([]);