Bug 7295: More granular permissions for baskets

[koha.git] / acqui / booksellers.pl

diff --git a/acqui/booksellers.pl b/acqui/booksellers.pl
index 634eb93..80a42f1 100755 (executable)
--- a/acqui/booksellers.pl
+++ b/acqui/booksellers.pl
@@ -41,7 +41,9 @@ C<$supplier> is the string with which we search for a supplier
 
 =back
 
-=item id or supplierid
+=over 4
+
+=item id or booksellerid
 
 The id of the supplier whose baskets we will display
 
@@ -53,16 +55,17 @@ use strict;
 use warnings;
 use C4::Auth;
 use C4::Biblio;
+use C4::Budgets;
 use C4::Output;
 use CGI;
 
-use C4::Dates qw/format_date/;
+use C4::Acquisition qw/ GetBasketsInfosByBookseller CanUserManageBasket /;
 use C4::Bookseller qw/ GetBookSellerFromId GetBookSeller /;
 use C4::Members qw/GetMember/;
 use C4::Context;
 
 my $query = CGI->new;
-my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
+my ( $template, $loggedinuser, $cookie, $userflags ) = get_template_and_user(
     {   template_name   => 'acqui/booksellers.tmpl',
         query           => $query,
         type            => 'intranet',
@@ -74,11 +77,12 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
 
 #parameters
 my $supplier = $query->param('supplier');
-my $id = $query->param('id') || $query->param('supplierid');
+my $booksellerid = $query->param('booksellerid');
+my $allbaskets= $query->param('allbaskets')||0;
 my @suppliers;
 
-if ($id) {
-    push @suppliers, GetBookSellerFromId($id);
+if ($booksellerid) {
+    push @suppliers, GetBookSellerFromId($booksellerid);
 } else {
     @suppliers = GetBookSeller($supplier);
 }
@@ -87,7 +91,8 @@ my $supplier_count = @suppliers;
 if ( $supplier_count == 1 ) {
     $template->param(
         supplier_name => $suppliers[0]->{'name'},
-        id            => $suppliers[0]->{'id'}
+        booksellerid  => $suppliers[0]->{'id'},
+        basketcount   => $suppliers[0]->{'basketcount'}
     );
 }
 
@@ -101,34 +106,35 @@ my $viewbaskets = C4::Context->preference('AcqViewBaskets');
 
 my $userbranch = $userenv->{branch};
 
+my $budgets = GetBudgetHierarchy;
+my $has_budgets = 0;
+foreach my $r (@{$budgets}) {
+    if (!defined $r->{budget_amount} || $r->{budget_amount} == 0) {
+        next;
+    }
+    next unless (CanUserUseBudget($loggedinuser, $r, $userflags));
+
+    $has_budgets = 1;
+    last;
+}
+
 #build result page
 my $loop_suppliers = [];
 
 for my $vendor (@suppliers) {
-    my $baskets = get_vendors_baskets( $vendor->{id} );
+    my $baskets = GetBasketsInfosByBookseller( $vendor->{id}, $allbaskets );
 
     my $loop_basket = [];
-    
+
     for my $basket ( @{$baskets} ) {
-        my $authorisedby = $basket->{authorisedby};
-        my $basketbranch = ''; # set a blank branch to start with
-        if ( GetMember( borrowernumber => $authorisedby ) ) {
-           # authorisedby may not be a valid borrowernumber; it's not foreign-key constrained!
-           $basketbranch = GetMember( borrowernumber => $authorisedby )->{branchcode};
-        }
-        
-        if ($userenv->{'flags'} & 1 || #user is superlibrarian
-               (haspermission( $uid, { acquisition => q{*} } ) && #user has acq permissions and
-                   ($viewbaskets eq 'all' || #user is allowed to see all baskets
-                   ($viewbaskets eq 'branch' && $authorisedby && $userbranch eq $basketbranch) || #basket belongs to user's branch
-                   ($basket->{authorisedby} &&  $viewbaskets == 'user' && $authorisedby == $loggedinuser) #user created this basket
-                   ) 
-                ) 
-           ) { 
-            for my $date_field (qw( creationdate closedate)) {
-                if ( $basket->{$date_field} ) {
-                    $basket->{$date_field} = format_date( $basket->{$date_field} );
-                }
+        if (CanUserManageBasket($loggedinuser, $basket, $userflags)) {
+            my $member = GetMember( borrowernumber => $basket->{authorisedby} );
+            foreach (qw(total_items total_biblios expected_items)) {
+                $basket->{$_} ||= 0;
+            }
+            if($member) {
+                $basket->{authorisedby_firstname} = $member->{firstname};
+                $basket->{authorisedby_surname} = $member->{surname};
             }
             push @{$loop_basket}, $basket; 
         }
@@ -136,7 +142,7 @@ for my $vendor (@suppliers) {
 
     push @{$loop_suppliers},
       { loop_basket => $loop_basket,
-        supplierid  => $vendor->{id},
+        booksellerid  => $vendor->{id},
         name        => $vendor->{name},
         active      => $vendor->{active},
       };
@@ -144,23 +150,10 @@ for my $vendor (@suppliers) {
 }
 $template->param(
     loop_suppliers => $loop_suppliers,
-    supplier       => ( $id || $supplier ),
+    supplier       => ( $booksellerid || $supplier ),
     count          => $supplier_count,
+    has_budgets          => $has_budgets,
 );
+$template->{VARS}->{'allbaskets'} = $allbaskets;
 
 output_html_with_http_headers $query, $cookie, $template->output;
-
-sub get_vendors_baskets {
-    my $supplier_id = shift;
-    my $dbh         = C4::Context->dbh;
-    my $sql         = <<'ENDSQL';
-select aqbasket.*, count(*) as total,  borrowers.firstname, borrowers.surname
-from aqbasket left join aqorders on aqorders.basketno = aqbasket.basketno
-left join borrowers on aqbasket.authorisedby = borrowers.borrowernumber
-where booksellerid = ?
-AND ( aqorders.quantity > aqorders.quantityreceived OR quantityreceived IS NULL)
-AND datecancellationprinted IS NULL
-group by basketno
-ENDSQL
-    return $dbh->selectall_arrayref( $sql, { Slice => {} }, $supplier_id );
-}