From 4d5977d6ef2066f03b10fd9976e64a4eab0c2b7f Mon Sep 17 00:00:00 2001
From: Jeff Davis <jdavis@sitka.bclibraries.ca>
Date: Tue, 28 Apr 2020 11:22:10 -0700
Subject: [PATCH] LP#1873048: add scoped retrieve perm for booking resource
 types

In the XUL client, when selecting a resource type, the list was limited
by owning library.  But in the web client, the list would show all
resource types across all libraries.  This commit addresses that
regression by adding a retrieve permission with context_field in the
IDL.  That way, users only see resource types owned by org units where
they have the ADMIN_BOOKING_RESOURCE_TYPE perm.

Signed-off-by: Jeff Davis <jdavis@sitka.bclibraries.ca>
---
 Open-ILS/examples/fm_IDL.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Open-ILS/examples/fm_IDL.xml b/Open-ILS/examples/fm_IDL.xml
index 7622efd0db..1b8c15b031 100644
--- a/Open-ILS/examples/fm_IDL.xml
+++ b/Open-ILS/examples/fm_IDL.xml
@@ -5011,7 +5011,7 @@ SELECT  usr,
 		<permacrud xmlns="http://open-ils.org/spec/opensrf/IDL/permacrud/v1">
 			<actions>
 				<create permission="ADMIN_BOOKING_RESOURCE_TYPE" context_field='owner'/>
-				<retrieve/>
+				<retrieve permission="ADMIN_BOOKING_RESOURCE_TYPE" context_field='owner'/>
 				<update permission="ADMIN_BOOKING_RESOURCE_TYPE" context_field='owner'/>
 				<delete permission="ADMIN_BOOKING_RESOURCE_TYPE" context_field='owner'/>
 			</actions>
-- 
2.11.0