Booking reservations should not require global permissions

[Jeff Davis]

In the IDL, permissions for booking.reservation and booking.reservation_attr_value_map are global in scope (global_required=true). These permissions should be scoped by org unit instead. Following action.hold_request, I would suggest using pickup_lib as the context field.

[Jeff Davis (jdavis-sitka)]

Working branch user/jeffdavis/lp1873048-lp1835127-booking-perms scopes reservation perms as suggested:

https://git.evergreen-ils.org/?p=working/Evergreen.git;a=commitdiff;h=0be427d6

There's an additional commit in that branch that adds a scoped retrieve perm for booking resource types (see bug 1873048).

[Jane Sandberg (sandbergja)]

Thanks for the branch, Jeff. I do have a concern about adding permission="ADMIN_BOOKING_RESOURCE_TYPE" back to retrieving brt. I removed that permission because of this issue: https://bugs.launchpad.net/evergreen/+bug/1816475/comments/19

Granted, there are other ways to address the issue Terran describes in that comment. But we should make sure to address it in another way before adding these perms back.

[Jeff Davis (jdavis-sitka)]

Good point. A separate view permission should do the trick, I think. I'll put together a branch for that.

[Jeff Davis (jdavis-sitka)]

Working branch user/jeffdavis/lp1835127-reservation-perms adds scoping and new view perms for reservations:

https://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/jeffdavis/lp1835127-reservation-perms

[Chris Sharp (chrissharp123)]

Pushed to rel_3_4, rel_3_5, and master. Thanks, Jeff and Jane!