Extra perms block line items loading in PO

[Tiffany Little]

Seen in 3.10 production.

It looks as though the permissions CREATE_PURCHASE_ORDER and ACQ_SET_LINEITEM_IDENTIFIER are both being required to load in line items in a purchase order. We have a permission group just for receiving, so it didn't have the ACQ_SET_LINEITEM_IDENTIFIER permission assigned. When someone with this permission would open a PO, the lineitem loading bar would spin indefinitely.

I tracked it through the logs, starting from open-ils.acq.lineitem.retrieve.batch and ending up in Lineitem.pm where on line 231 it looks like it requires VIEW_PURCHASE_ORDER and CREATE_PURCHASE_ORDER both to retrieve a lineitem. It shouldn't require CREATE_PURCHASE_ORDER just to retrieve a line item. I didn't realize this was causing a problem at first because apparently CREATE_PURCHASE_ORDER is set in the base Acquisitions permission group at the consortial level, and that's what all our perm groups are derived from. So it's not that it was necessarily *causing* this particular issue, but it doesn't seem like a good idea. But that's a different kettle of fish....

The second perm at issue is ACQ_SET_LINEITEM_IDENTIFIER. I haven't quite figured out *why* this is being called, but I tracked it from lineitem.service.ts which is calling open-ils.acq.lineitem.order_identifier.set and on the front end talks to orderIdentChanged in lineitem-list.component.html. Does it think that just loading the page is an event and so it's calling orderIdentChanged? That's in the default Acquisitions profile too, which obviously we customized *that* at some point, but the point is that it shouldn't be required just to load up a PO.

[Lindsay Stratton (lstratton)]

I can confirm CREATE_PURCHASE_ORDER, VIEW_PURCHASE_ORDER, and ACQ_SET_LINEITEM_IDENTIFIER are needed to load line items / POs in 3.10

In our production server, our primary Acquisitions permission group (which is not as granular as Tiffany's) included CREATE_PURCHASE_ORDER and VIEW_PURCHASE_ORDER but not ACQ_SET_LINEITEM_IDENTIFIER. After upgrading to 3.10 we had been having very inconsistent results loading line items, where some POs would not load at all but some POs would load some of the line items. This was not an issue in 3.8.

Once I added ACQ_SET_LINEITEM_IDENTIFIER line items were loading consistently for all POs. Other member library ACQ staff also confirm.

In our test server, I tested again:

- VIEW_PURCHASE_ORDER only: no difference from original production behavior
- CREATE_PURCHASE_ORDER and ACQ_SET_LINEITEM_IDENTIFIER: resulted in a permission denied popup
- VIEW_PURCHASE_ORDER, CREATE_PURCHASE_ORDER and ACQ_SET_LINEITEM_IDENTIFIER: able to load POs and all line items fully and consistenyl