Uploaded image for project: 'mod-orders'
  1. mod-orders
  2. MODORDERS-206

Missing modulePermission in POST /orders/composite-orders

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • P1
    • Resolution: Done
    • None
    • 5.0.0
    • folio-testing

    • ACQ Sprint 60
    • 1
    • EBSCO - FSE

    Description

      Overview:
      You can't currently place an order via POST /orders/composite-orders when having only the orders.item.post permission...

      {
      	"endpoint": "/orders/composite - orders",
      	"statusCode": 500,
      	"errorMessage": {
      		"error": [{
      			"message": "Access requires permission: orders-storage.purchase-orders.collection.get",
      			"code": "genericError",
      			"parameters": []
      		}],
      		"total_records": 1
      	}
      }
      

      As you can see below orders-storage.purchase-orders.collection.get permission is absent from the modulePermissions section of this endpoint.

              {
                "methods": ["POST"],
                "pathPattern": "/orders/composite-orders",
                "permissionsRequired": ["orders.item.post"],
                "modulePermissions": [
                  "orders-storage.purchase-orders.item.post",
                  "orders-storage.po-lines.item.post",
                  "orders-storage.pieces.item.post",
                  "orders-storage.pieces.collection.get",
                  "orders-storage.po-number.get",
                  "orders-storage.alerts.item.post",
                  "orders-storage.reporting-codes.item.post",
                  "configuration.entries.collection.get",
                  "inventory-storage.identifier-types.collection.get",
                  "inventory.instances.collection.get",
                  "inventory.instances.item.post",
                  "inventory-storage.instance-types.collection.get",
                  "inventory-storage.instance-statuses.collection.get",
                  "inventory-storage.holdings.item.post",
                  "inventory-storage.holdings.collection.get",
                  "inventory-storage.items.collection.get",
                  "inventory-storage.items.item.post",
                  "inventory-storage.loan-types.collection.get",
                  "vendor-storage.vendors.collection.get",
                  "vendor-storage.vendors.item.get"
                ]
              },
      

      Expected Behavior:

      • You should be able to place an order while having only the orders.item.post permission.

      Actual Behavior:

      • You receive the error message above.

      Acceptance Criteria:

      • The needed permission has been added to the modulePermissions section of the appropriate endpoint in the module descriptor.

      TestRail: Results

        Attachments

          Issue Links

            Activity

              People

                cmcnally Craig McNally
                cmcnally Craig McNally
                Craig McNally Craig McNally
                Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved:

                  TestRail: Runs

                    TestRail: Cases