Bug 10277 - Add C4::Context->IsSuperLibrarian()

The method of checking the logged in user for superlibrarian privileges
is obtuse ( $userenv && $userenv->{flags} % 2 != 1 ) to say the least.
The codebase is littered with these lines, with no explanation given. It
would be much better if we had one subroutine that returned a boolean
value to tell us if the logged in user is a superlibrarian or not.

Test Plan:
1) Apply this patch
2) Verify superlibrarian behavior remains unchanged

Signed-off-by: Joel Sasse <jsasse@plumcreeklibrary.net>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Comments on second patch.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit fb4025b67b45e60154f67b9acca3d56e4f5eb7c5)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 10277: Add UT for C4::Context::IsSuperLibrarian

Note that I modify the return value. Before this patch, it returned an
empty string or 1. Now it returns 0 or 1.

Test plan:
- same as the original patch
- verify that unit tests pass:
    prove t/Context.t

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script, including new tests.
Checked the code and tested superlibrarian behaviour in some places:

moremember.pl:
With IndyBranches only superlibrarian can delete borrowers from
other branches. Accessing the borrower with a direct link.
OK

C4/Members.pm
With IndyBranches only superlibrarian can search for borrowres
from other branches.
OK

tools/holidays.pl
With IndyBranches only superlibrarian can edit holidays for other
branches.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 3e866d216db008e1ed8c8614f6758ad5118321df)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 10277: (follow-up) if no userenv is set, act like a superlibrarian

This patch fixes an error caught by t/db_dependent/Acquisition.t, and
adjusts C4::Context::IsSuperLibrarian() to return true if no
userenv is set. This is done on the basis that if no userenv is set,
calls to C4::Context routines are being made from a command-line script,
and if you have access to the command line of a running Koha instance,
you implicitly already have better than superlibrarian access.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 71b7d5629878bd5616dbb1db263a8fd943d3f7b9)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 7002: fix some invalid superlibrarian permission checks

This patch fixes a problem where if a staff user has superlibrarian
permissions, but also has module-specific permissions, they are
prevent from editing item records that they should be allowed to.

To test:

[1] Turn on IndependentBranches.
[2] Register a superlibrarian staff user at branch A.
[3] Give that new account at least one other module-level
    permission.  This cannot be done through the user interface,
    however, but can be done via SQL:

    UPDATE borrowers SET flags = 3 WHERE userid = 'XXX';

[4] Log in as that new superlibrarian.
[5] Bring up the item details (catalogue/moredetail.pl) page for
    an item at branch B.  Note that there is no 'Edit Item' link.
[6] Similarly, try editing that item (cataloging/additem.pl).  Note
    that the edit form forbids you from touching the item.
[7] Finally, try editing that item using the Tools | Batch item
    modification utility.  Note that it doesn't allow you to do so.
[8] Apply the patch.
[9] Repeat steps 5 through 7.  This time, the item actions should
    be allowed.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works as described, passes QA script and test suite.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit bb750253644e0ba6ea04e36c80088626e8163bf2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 11587 - IsSuperLibrarian generates warnings (UT)

Simply viewing OPAC detail triggers a modulus warning entry.
This first patch adds two test cases to t/Context.t to test for
this situation.

TEST PLAN
---------
1) Apply this patch (to upgrade t/Context.t)
2) prove -v t/Context.t
-- Tests 7 and 8 will fail
3) Apply main patch (to amend C4/Context.pm)
4) prove -v t/Context.t
-- All tests will succeed

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 8ee0bc049a183e795fc37608a4b3790d4aef2267)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Conflicts:
	t/Context.t
Bug 11587 - Add UT for IsSuperLibrarian if flags == 0

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 850e7e58352fd1fcb2772308cbfc6375b6a45735)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Conflicts:
	t/Context.t
Bug 11587: get rid of warnings generated by IsSuperLibrarian with anonymous sessions

This corrects line 1250 of C4/Context.pm to be:
    return ($userenv->{flags}//0) % 2;
And thus avoids an uninitialized value used in the modulus.

TEST PLAN
---------
1) Apply the first patch (to update t/Context.t)
2) prove -v t/Context.t
-- This should fail tests 7 and 8
3) Apply this patch (to fix C4/Context.pm)
4) prove -v t/Context.t
-- All tests should succeed

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit bf3b1aac7b7bc422bea26bb2c045be69d93ef0bf)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 12048: add regression test

This patch adds a regression test for verifying that superlibrarians
can see all subscription when IndependentBranches is on.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 9af0aa288c23a6722333adebba7b8b3e12ed78e2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 12048: restore ability of superlibrarian to see other libraries' subscriptions

This patch fixes a regression in master and 3.14. When a user has
superlibrian permissions, a search on serials subscriptions should
display other libraries' subscriptions even when IndependentBranches
syspref is enabled.

To reproduce/test the bug/patch:

1. Enable IndependentBranches (i.e. 'Prevent' staff...)
2. Login as a user not having superlibrarian permission
3. Search for a serial subscription on:
   /cgi-bin/koha/serials/serials-search.pl
4. Search a title which has at least 2 subscriptions: one in the user
   branch, and one in another branch
5. On the result page, just 1 subscription is displayed: the one
   attached to the userbranch
   => this is normal
6. Login as a user having superlibrarian permission
7. Repeat step 3-5.
8. You get the same result as 5. You should have seen all subscriptions.
   That's what you get after applying this patch.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

NOTE: I tested a variation. My superlibrarian was a branch that
      was not the same as the non-superlibrarian. The serial was
      the same branch as the non-superlibrarian. Without the
      patch, the superlibrarian saw nothing, with the patch it
      saw the serial as expected.
      Also, remember the superserials permission can affect the
      results. I successfully changed the branch of the
      subscription, and then it ceased to show up with
      superserials not granted to the non-superlibrarian.
      I corrected the system preference name in the text here.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Superlibrarian permission now allows to see all subscriptions
independent from the branch.
Passes all tests and QA script.

But the superserials permission appears broken to me before
and after this patch. If I have superserials - the search
doesn't show all subscriptions. If I don't have superserials
I can still edit any subscription accessing the subscription
detail page through the serial collection page or accessing
the detail page directly by manipulating the URL.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 214d6b8d13c553027c868a00a2dd6b313f56608b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 12080: restore effect of superserials permission

The superserials permission is meant to allow an operator
to see all subscriptions regardless of branch when IndependentBranches
is on without having to have full superlibrarian permissions.  This
patch restores this behavior.

TEST PLAN
---------
1) Apply the patch for bug 12048 (as needed -- it may be pushed)
2) Ensure you have two users: superlibrarian, non-superlibrarian
   with all access to the staff client except superserials.
3) Ensure you have serials belonging to a different branch than
   the non-superlibrarian.
3) Log into staff client as superlibrarian
4) Click 'Serials'
5) Click the 'Submit' button in the search area.
   -- note the number of results.
6) Log into staff client as non-superlibrarian
7) Click 'Serials'
8) Click the 'Submit' button in the search area.
   -- note the number should be less, note the number.
9) Give the non-superlibrarian superserials access.
10) Home -> Serials
11) Click the 'Submit' button in the search area.
   -- the number will still be the same at the one in step #8.
12) Apply the patch
13) Refresh the page
   -- the number should now match the one in step #5.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit f0e574be4a834b28b0e19f2964f5de989f0e6665)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 12080: (follow-up) fix test failure and warnings in Bookseller.t

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Fixes the tests as promised.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit b772969cddce53d72bfd27bfda0ee094b1332e9d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 12098: Fix C4::Serials::can_edit_subscription

This patch fixes a problem whereby staff users could
edit subscriptions they are not permitted to by going directly
to the subscription details page.

It also adds some unit tests for the can_edit_subscription routine
and add a new can_show_subscription routines.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Notes on second patch.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 4f7803e469a41cafb993c6d41e6481499e6cca93)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 12098: Refactor can_*_subscription in C4::Serials

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Tested on top of patches for 12048 and 12080.

Subscription search
- superlibrarian, IndyBranches on/off - always sees all subscriptions
- superserials, IndyBranches on/off - always sees all subscriptions
- no superserials, IndyBranches on - only sees own subscriptions
Note: Subscriptions without branches will only show, when all subscriptions
      are visible. In a future enh it might be good to enforce setting a
      branch, when IndyBranches is used.
- no superserials, IndyBranches off - always sees all subscriptions

Subscription editing
- superlibrarian, IndyBranches on/off - can edit all subscriptions
- superserials, IndyBranches on/off - can edit all subscriptions
- no superserials, IndyBranches on - can only edit own subscriptons and
  subscriptions without branch
  NOTE: it would make sense to also allow Edit > Edit as new (duplicate)
  here, so one can copy the subscription from another branch to modify
  it for the own branch.

Passes tests in t, xt and QA script, also newly provided unit tests.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 4d78b9588a9f5fc68142b9d1556686072e7b5dba)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 12098: (follow-up) deal with FIXMEs in t/db_dependent/Serials_2.t

This patch nails down the number of tests to be run.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit be3ce1e7a2477b02d4c071543405898c21380926)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 12098: (follow-up) put can_show_subscription() into use

This patch puts C4::Serials::can_show_subscription() into use.

Note that there is user-visible change: if a subscription has a
blank library, all users with serials permissions will be able
to view and/or edit it.  It remains to be determined whether
we *want* such subscriptions to exist, or if they should only
be tied to specific libraries.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit dc6d8a2199f79e36839a2769994883e04b61cb67)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>