From d7f1f1d917f39fe11fed8a069a96d7e75fb5e276 Mon Sep 17 00:00:00 2001
From: erickson <erickson@dcc99617-32d9-48b4-a31d-7c20da2025e4>
Date: Mon, 4 May 2009 21:32:39 +0000
Subject: [PATCH] check explicit perm on importing on-order record and only
 when necessary

git-svn-id: svn://svn.open-ils.org/ILS/trunk@13064 dcc99617-32d9-48b4-a31d-7c20da2025e4
---
 .../src/perlmods/OpenILS/Application/Acq/Order.pm   | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/Open-ILS/src/perlmods/OpenILS/Application/Acq/Order.pm b/Open-ILS/src/perlmods/OpenILS/Application/Acq/Order.pm
index f7d494f26..1cadd4f61 100644
--- a/Open-ILS/src/perlmods/OpenILS/Application/Acq/Order.pm
+++ b/Open-ILS/src/perlmods/OpenILS/Application/Acq/Order.pm
@@ -218,6 +218,8 @@ sub delete_lineitem {
 # begins and commit transactions as it goes
 sub create_lineitem_list_assets {
     my($mgr, $li_ids) = @_;
+    return undef if check_asset_create_perms($mgr, $li_ids);
+
     # create the bibs/volumes/copies and ingest the records
     for my $li_id (@$li_ids) {
         $mgr->editor->xact_begin;
@@ -230,6 +232,24 @@ sub create_lineitem_list_assets {
     return 1;
 }
 
+# returns event on error, undef on success
+sub check_import_marc_perms {
+    my($mgr, $li_ids) = @_;
+
+    # if there are any order records that are not linked to 
+    # in-db bib records, verify staff has perms to import order records
+    my $order_li = $mgr->editor->search_acq_lineitem(
+        [{id => $li_ids, eg_bib_id => undef}, {limit => 1}], {idlist => 1})->[0];
+
+    if($order_li) {
+        return $mgr->editor->die_event unless 
+            $mgr->editor->allowed('IMPORT_ACQ_LINEITEM_BIB_RECORD');
+    }
+
+    return undef;
+}
+
+
 # ----------------------------------------------------------------------------
 # if all of the lineitem details for this lineitem have 
 # been received, mark the lineitem as received
@@ -1213,7 +1233,6 @@ sub create_po_assets {
     my $mgr = OpenILS::Application::Acq::BatchManager->new(editor => $e, conn => $conn);
 
     my $po = $e->retrieve_acq_purchase_order($po_id) or return $e->die_event;
-    return $e->die_event unless $e->allowed('IMPORT_PURCHASE_ORDER_ASSETS', $po->ordering_agency);
 
     my $li_ids = $e->search_acq_lineitem({purchase_order => $po_id}, {idlist => 1});
 
-- 
2.11.0