Hold Groups: Staff Users Cannot View Patron Hold Groups

[Michele Morgan]

Evergreen 3.7

When viewing Hold Groups from a patron's record as a staff user, the grid is blank, no Hold Groups to which the patron belongs appear on the screen. Only staff users that are superusers can see the patron's Hold Groups.

To reproduce on a concerto system:

* Login as admin and add the permission MANAGE_HOLD_GROUPS at the Consortium level to the staff user br1bbrown
* Login to a BR1 workstation as br1bbrown
* Navigate to Circulation -> Hold Groups.
* Add a Hold Group.
* Select the hold group you just added and click Add Users
* Add the user barcode 99999376864
* Click on the barcode to retrieve the patron record
* Navigate to Other -> Hold Groups

Note that no Hold Groups display

* Login as the admin user
* Retrieve the patron and navigate to Other -> Hold Groups

Note that the Hold Group to which the patron belongs displays for the superuser

[Michele Morgan (mmorgan)]

Thanks for looking at this Lynn, but unless I'm misreading it, bug 1955999 is related, but not the same.

1955999 reports that in Circulation -> Hold Groups, a hold group can only be seen by its owning staff user, or a superuser.

This bug reports that for a patron in Checkout -> Other -> Hold Groups, the hold groups to which the patron belongs can ONLY be seen by a superuser.

I'm removing the duplicate designation for now.

[Lynn Floyd (lfloyd)]

You are correct, I miss read that.

[Terran McCanna (tmccanna)]

Adding usability tag as well since it prevents a staff person from helping a patron if they come to the desk to ask what hold groups they are in.

[Elizabeth Thomsen (et-8)]

I agree that this is a usability issue -- having this on the list but not working is worse than not having it there at all. If it weren't there at all, a staff person wouldn't be able to help the patron who wants to know what hold groups they are in, but that would be better than the staff person checking this, assuming it's working, and telling the patron they aren't in any hold groups at all.

[Michele Morgan (mmorgan)]

Confirming that this is still true in current main (circa 3.11).

[Michele Morgan (mmorgan)]

The following user bucket permissions defined in the fm_IDL were missing from the seed data.

This patch adds the missing permissions and maps them to the Circulation Administrator and Circulators permission groups. Here's a link to the working branch:

https://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/mmorgan/LP1956241_add_missing_user_bucket_permissions

user/mmorgan/LP1956241_add_missing_user_bucket_permissions

To test on a Concerto system:

Add a hold group under Circulation -> Hold Groups
Add a patron to your hold group
Login as a Circulator
Retrieve the patron
Navigate to Other - Hold Groups
Note that the hold group to which the patron belongs does not appear

Apply the patch

Login as a Circulator
Retrieve the patron
Navigate to Other - Hold Groups
Note that the hold group to which the patron belongs now appears

[Elizabeth Davis (elidavis)]

I have tested this, and it is working as outlined in Michele's instructions. Is this set at the system level? It's the behavior I'm seeing but wanted to confirm.

[Terran McCanna (tmccanna)]

There is a small discrepancy between the two SQL files - the upgrade file adds the new permissions to both the Circulator and Circulation Administrator permission groups, but the seed data file only adds them to Circulators.

In response to Elizabeth's comment #7 - yes, the seed data has the permissions set to the system level, but it would be good to test that at branch level or consortium level as well (by editing the permission depth for the new permissions in Administration > Server Administration > Permission Groups where 0 basically equates to the consortial level, 1 to the system level, and 2 to the branch level).

[Ruth Frasur Davis (redavis)]

Elizabeth, it appears to be at a system level for circulators, but not showing for circulation administrators.

With that said, they appear to be function per the fm_IDL correctly.

[Ruth Frasur Davis (redavis)]

I have tested this patch and confirm that it behaves as expected. I'm signing off with my username, rfrasur, and email address, <email address hidden>.

[Michele Morgan (mmorgan)]

I've force pushed a branch that fixes the discrepancies between the upgrade script and the seed data. Both the upgrade script and the seed data now assign the permissions to the Circulators and Circulation Administrator groups at the SYSTEM level.

I've also added Ruth's signoff.

Echoing the link to the branch here:

https://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/mmorgan/LP1956241_add_missing_user_bucket_permissions

[Terran McCanna (tmccanna)]

Looks good! Added my sign off to the latest and greatest:

https://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/mccanna/LP1956241_add_missing_user_bucket_permissions_signoff

[Michele Morgan (mmorgan)]

Pushed to main for inclusion in 3.12.

Thanks Ruth and Terran!