UIIN-3187: ECS: Disable opening item details if a user is not affiliated with item's member tenant

CHANGELOG.md

@@ -12,6 +12,7 @@
 * Add "linked-data 1.0" interface to "optionalOkapiInterfaces". Refs UIIN-3166.
 * Fix infinite loading animation after cancel edit/duplicate or 'Save & Close' consortial holdings/items. Fixes UIIN-3167.
 * Remove hover-over text next to "Effective call number" on the Item record detail view. Refs UIIN-3131.
+* ECS: Disable opening item details if a user is not affiliated with item's member tenant. Fixes UIIN-3187.
 
 ## [12.0.8](https://github.com/folio-org/ui-inventory/tree/v12.0.8) (2024-12-24)
 [Full Changelog](https://github.com/folio-org/ui-inventory/compare/v12.0.7...v12.0.8)

src/components/InstancesList/InstancesList.js

@@ -28,6 +28,7 @@ import {
   withNamespace,
   checkIfUserInCentralTenant,
   TitleManager,
+  getUserTenantsPermissions,
 } from '@folio/stripes/core';
 import {
   SearchAndSort,
@@ -83,6 +84,7 @@ import {
   replaceFilter,
   batchQueryIntoSmaller,
   getSortOptions,
+  hasMemberTenantPermission,
 } from '../../utils';
 import {
   INSTANCES_ID_REPORT_TIMEOUT,
@@ -213,6 +215,7 @@ class InstancesList extends React.Component {
       searchAndSortKey: 0,
       segmentsSortBy: this.getInitialSegmentsSortBy(),
       searchInProgress: false,
+      userTenantPermissions: [],
     };
   }
 
@@ -222,6 +225,7 @@ class InstancesList extends React.Component {
       location: _location,
       getParams,
       data,
+      stripes,
     } = this.props;
 
     const params = getParams();
@@ -260,6 +264,10 @@ class InstancesList extends React.Component {
     if (isSortingUpdated || isStaffSuppressFilterChanged) {
       this.redirectToSearchParams(searchParams);
     }
+
+    if (isUserInConsortiumMode(stripes)) {
+      this.getCurrentTenantPermissions();
+    }
   }
 
   componentDidUpdate(prevProps) {
@@ -1190,6 +1198,15 @@ class InstancesList extends React.Component {
     };
   }
 
+  getCurrentTenantPermissions = () => {
+    const {
+      stripes,
+      stripes: { user: { user: { tenants } } },
+    } = this.props;
+
+    getUserTenantsPermissions(stripes, tenants).then(userTenantPermissions => this.setState({ userTenantPermissions }));
+  }
+
   findAndOpenItem = async (instance) => {
     const {
       parentResources,
@@ -1213,6 +1230,17 @@ class InstancesList extends React.Component {
 
     const tenantItemBelongsTo = instance?.items?.[0]?.tenantId || stripes.okapi.tenant;
 
+    // if a user is not affiliated with the item's member tenant then item details cannot be open
+    if (isUserInConsortiumMode(stripes)) {
+      const tenants = stripes.user.user.tenants || [];
+      const isUserAffiliatedWithMemberTenant = tenants.find(tenant => tenant?.id === tenantItemBelongsTo);
+      const canMemberTenantViewItems = hasMemberTenantPermission('ui-inventory.instance.view', tenantItemBelongsTo, this.state.userTenantPermissions);
+
+      if (isEmpty(isUserAffiliatedWithMemberTenant) || !canMemberTenantViewItems) {
+        return instance;
+      }
+    }
+
     itemsByQuery.reset();
     const items = await itemsByQuery.GET({
       params: { query: itemQuery },