From b7bd25885eafbaa49eb7cc6deedfe9f473ab2db5 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 2 Sep 2025 10:17:10 +0200
Subject: [PATCH] Bug 40684: Adjust permissions for vendors

The acquisition config route should be accessible to users
with at least one acquisition subpermission or erm permission.

The list vendors route should be accessible to users with the erm
permission.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 api/v1/swagger/paths/acquisitions_vendors.yaml        | 7 ++++---
 api/v1/swagger/paths/acquisitions_vendors_config.yaml | 3 ++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/api/v1/swagger/paths/acquisitions_vendors.yaml b/api/v1/swagger/paths/acquisitions_vendors.yaml
index a7ba8450f6..73839cd342 100644
--- a/api/v1/swagger/paths/acquisitions_vendors.yaml
+++ b/api/v1/swagger/paths/acquisitions_vendors.yaml
@@ -78,9 +78,10 @@
           $ref: "../swagger.yaml#/definitions/error"
     x-koha-authorization:
       permissions:
-        acquisition:
-          - vendors_manage
-          - marc_order_manage
+        - acquisition:
+            - vendors_manage
+            - marc_order_manage
+        - erm: 1
   post:
     x-mojo-to: Acquisitions::Vendors#add
     operationId: addVendor
diff --git a/api/v1/swagger/paths/acquisitions_vendors_config.yaml b/api/v1/swagger/paths/acquisitions_vendors_config.yaml
index 4bc3e814ec..e585309a5f 100644
--- a/api/v1/swagger/paths/acquisitions_vendors_config.yaml
+++ b/api/v1/swagger/paths/acquisitions_vendors_config.yaml
@@ -35,4 +35,5 @@
           $ref: "../swagger.yaml#/definitions/error"
     x-koha-authorization:
       permissions:
-        acquisition: 1
+        - acquisition: '*'
+        - erm: 1