Merge pull request #1244 from openlibraryenvironment/OLE-9403

OLE-9403 : Need permissions to lock down deliver functions

ole-app/ole-db/ole-liquibase/ole-liquibase-upgrade/src/main/resources/org/kuali/ole/3.0.15/data/ole_krim_perm_attr_data_t.csv

@@ -0,0 +1,3 @@
+ATTR_DATA_ID,OBJ_ID,VER_NBR,PERM_ID,KIM_TYP_ID,KIM_ATTR_DEFN_ID,ATTR_VAL
+OLELOAN1001,OLELOAN1001,1,OLELOAN1012,56,13,PatronBillMaintenanceDocument
+OLELOAN1002,OLELOAN1002,1,OLELOAN1012,56,7,FALSE

ole-app/ole-db/ole-liquibase/ole-liquibase-upgrade/src/main/resources/org/kuali/ole/3.0.15/data/ole_krim_perm_t.csv

@@ -0,0 +1,14 @@
+PERM_ID,OBJ_ID,VER_NBR,PERM_TMPL_ID,NMSPC_CD,NM,DESC_TXT,ACTV_IND
+OLELOAN1001,OLELOAN1001,1,56,OLE-DLVR,View Alter Due Date Button,Allows users to viea and access Alter Due Date Operation.,Y
+OLELOAN1002,OLELOAN1002,1,56,OLE-DLVR,View Replace Copy Button,Allows users to view and access Replace Copy Operation.,Y
+OLELOAN1003,OLELOAN1003,1,56,OLE-DLVR,View Claims Return Button,Allows users to view and access Claims Return Operation.,Y
+OLELOAN1004,OLELOAN1004,1,56,OLE-DLVR,View Bill Item as Lost Button,Allows users to view and access Bill Item as Lost Operation..,Y
+OLELOAN1005,OLELOAN1005,1,56,OLE-DLVR,View Missing Piece Button,Allows users to view and access Missing Piece Operation.,Y
+OLELOAN1006,OLELOAN1006,1,56,OLE-DLVR,View Damaged Button,Allows users to view and access Damaged Operation.,Y
+OLELOAN1007,OLELOAN1007,1,56,OLE-DLVR,View Cancel Button,Allows users to view and access Cancel Operation..,Y
+OLELOAN1008,OLELOAN1008,1,56,OLE-DLVR,View Cancel Credit Button,Allows users to view and access Cancel Credit Operation.,Y
+OLELOAN1009,OLELOAN1009,1,56,OLE-DLVR,View Error Button,Allows users to view and access Error Operation,Y
+OLELOAN1010,OLELOAN1010,1,56,OLE-DLVR,View Claims Return Screen,Allows users to view and access Claims Return Screen.,Y
+OLELOAN1011,OLELOAN1011,1,56,OLE-DLVR,Override Patron Block,Allows users to view and access Override Patron.,Y
+OLELOAN1012,OLELOAN1012,1,42,OLE-DLVR,View Create Bill Screen,Allows users to view and access Create Bill Screen.,Y
+

ole-app/ole-db/ole-liquibase/ole-liquibase-upgrade/src/main/resources/org/kuali/ole/3.0.15/db.changelog-20181005.xml

@@ -26,4 +26,26 @@
             </delete>
         </rollback>
     </changeSet>
+    <changeSet context="bootstrap" author="ole" id="OLE_KRIM_PERM_T_mysql" dbms="mysql">
+        <sql>
+            SET sql_mode='NO_BACKSLASH_ESCAPES'
+        </sql>
+        <loadData tableName="KRIM_PERM_T" file="org/kuali/ole/3.0.15/data/ole_krim_perm_t.csv"/>
+        <rollback>
+            <delete tableName="KRIM_PERM_T">
+                <where>APPL_NMSPC_CD = 'OLE'</where>
+            </delete>
+        </rollback>
+    </changeSet>
+    <changeSet context="bootstrap" author="ole" id="OLE_KRIM_PERM_ATTR_DATA_T_mysql" dbms="mysql">
+        <sql>
+            SET sql_mode='NO_BACKSLASH_ESCAPES'
+        </sql>
+        <loadData tableName="KRIM_PERM_ATTR_DATA_T" file="org/kuali/ole/3.0.15/data/ole_krim_perm_attr_data_t.csv"/>
+        <rollback>
+            <delete tableName="KRIM_PERM_ATTR_DATA_T">
+                <where>APPL_NMSPC_CD = 'OLE'</where>
+            </delete>
+        </rollback>
+    </changeSet>
 </databaseChangeLog>

ole-app/ole-db/ole-sql/ole-liquibase-upgrade-sql/src/main/resources/org/kuali/ole/sql/mysql/3.0.15.sql

@@ -36,5 +36,61 @@ INSERT INTO KRCR_PARM_T (NMSPC_CD, CMPNT_CD, PARM_NM, OBJ_ID, VER_NBR, PARM_TYP_
 INSERT INTO DATABASECHANGELOG (ID, AUTHOR, FILENAME, DATEEXECUTED, ORDEREXECUTED, MD5SUM, DESCRIPTION, COMMENTS, EXECTYPE, LIQUIBASE) VALUES ('OLE_LOAD_KRCR_PARM_T_mysql', 'ole', 'org/kuali/ole/3.0.15/db.changelog-20181005.xml', NOW(), 4, '7:fceda5239a279bc2e7540789903dcb9b', 'sql, loadData', '', 'EXECUTED', '3.2.0')
 /
 
+--  Changeset org/kuali/ole/3.0.15/db.changelog-20181005.xml::OLE_KRIM_PERM_T_mysql::ole
+SET sql_mode='NO_BACKSLASH_ESCAPES'
+/
+
+INSERT INTO KRIM_PERM_T (PERM_ID, OBJ_ID, VER_NBR, PERM_TMPL_ID, NMSPC_CD, NM, DESC_TXT, ACTV_IND) VALUES ('OLELOAN1001', 'OLELOAN1001', '1', '56', 'OLE-DLVR', 'View Alter Due Date Button', 'Allows users to viea and access Alter Due Date Operation.', 'Y')
+/
+
+INSERT INTO KRIM_PERM_T (PERM_ID, OBJ_ID, VER_NBR, PERM_TMPL_ID, NMSPC_CD, NM, DESC_TXT, ACTV_IND) VALUES ('OLELOAN1002', 'OLELOAN1002', '1', '56', 'OLE-DLVR', 'View Replace Copy Button', 'Allows users to view and access Replace Copy Operation.', 'Y')
+/
+
+INSERT INTO KRIM_PERM_T (PERM_ID, OBJ_ID, VER_NBR, PERM_TMPL_ID, NMSPC_CD, NM, DESC_TXT, ACTV_IND) VALUES ('OLELOAN1003', 'OLELOAN1003', '1', '56', 'OLE-DLVR', 'View Claims Return Button', 'Allows users to view and access Claims Return Operation.', 'Y')
+/
+
+INSERT INTO KRIM_PERM_T (PERM_ID, OBJ_ID, VER_NBR, PERM_TMPL_ID, NMSPC_CD, NM, DESC_TXT, ACTV_IND) VALUES ('OLELOAN1004', 'OLELOAN1004', '1', '56', 'OLE-DLVR', 'View Bill Item as Lost Button', 'Allows users to view and access Bill Item as Lost Operation..', 'Y')
+/
+
+INSERT INTO KRIM_PERM_T (PERM_ID, OBJ_ID, VER_NBR, PERM_TMPL_ID, NMSPC_CD, NM, DESC_TXT, ACTV_IND) VALUES ('OLELOAN1005', 'OLELOAN1005', '1', '56', 'OLE-DLVR', 'View Missing Piece Button', 'Allows users to view and access Missing Piece Operation.', 'Y')
+/
+
+INSERT INTO KRIM_PERM_T (PERM_ID, OBJ_ID, VER_NBR, PERM_TMPL_ID, NMSPC_CD, NM, DESC_TXT, ACTV_IND) VALUES ('OLELOAN1006', 'OLELOAN1006', '1', '56', 'OLE-DLVR', 'View Damaged Button', 'Allows users to view and access Damaged Operation.', 'Y')
+/
+
+INSERT INTO KRIM_PERM_T (PERM_ID, OBJ_ID, VER_NBR, PERM_TMPL_ID, NMSPC_CD, NM, DESC_TXT, ACTV_IND) VALUES ('OLELOAN1007', 'OLELOAN1007', '1', '56', 'OLE-DLVR', 'View Cancel Button', 'Allows users to view and access Cancel Operation..', 'Y')
+/
+
+INSERT INTO KRIM_PERM_T (PERM_ID, OBJ_ID, VER_NBR, PERM_TMPL_ID, NMSPC_CD, NM, DESC_TXT, ACTV_IND) VALUES ('OLELOAN1008', 'OLELOAN1008', '1', '56', 'OLE-DLVR', 'View Cancel Credit Button', 'Allows users to view and access Cancel Credit Operation.', 'Y')
+/
+
+INSERT INTO KRIM_PERM_T (PERM_ID, OBJ_ID, VER_NBR, PERM_TMPL_ID, NMSPC_CD, NM, DESC_TXT, ACTV_IND) VALUES ('OLELOAN1009', 'OLELOAN1009', '1', '56', 'OLE-DLVR', 'View Error Button', 'Allows users to view and access Error Operation', 'Y')
+/
+
+INSERT INTO KRIM_PERM_T (PERM_ID, OBJ_ID, VER_NBR, PERM_TMPL_ID, NMSPC_CD, NM, DESC_TXT, ACTV_IND) VALUES ('OLELOAN1010', 'OLELOAN1010', '1', '56', 'OLE-DLVR', 'View Claims Return Screen', 'Allows users to view and access Claims Return Screen.', 'Y')
+/
+
+INSERT INTO KRIM_PERM_T (PERM_ID, OBJ_ID, VER_NBR, PERM_TMPL_ID, NMSPC_CD, NM, DESC_TXT, ACTV_IND) VALUES ('OLELOAN1011', 'OLELOAN1011', '1', '56', 'OLE-DLVR', 'Override Patron Block', 'Allows users to view and access Override Patron.', 'Y')
+/
+
+INSERT INTO KRIM_PERM_T (PERM_ID, OBJ_ID, VER_NBR, PERM_TMPL_ID, NMSPC_CD, NM, DESC_TXT, ACTV_IND) VALUES ('OLELOAN1012', 'OLELOAN1012', '1', '42', 'OLE-DLVR', 'View Create Bill Screen', 'Allows users to view and access Create Bill Screen.', 'Y')
+/
+
+INSERT INTO DATABASECHANGELOG (ID, AUTHOR, FILENAME, DATEEXECUTED, ORDEREXECUTED, MD5SUM, DESCRIPTION, COMMENTS, EXECTYPE, LIQUIBASE) VALUES ('OLE_KRIM_PERM_T_mysql', 'ole', 'org/kuali/ole/3.0.15/db.changelog-20181005.xml', NOW(), 5, '7:f5a9afa66cf73d05f0c13f963b855911', 'sql, loadData', '', 'EXECUTED', '3.2.0')
+/
+
+--  Changeset org/kuali/ole/3.0.15/db.changelog-20181005.xml::OLE_KRIM_PERM_ATTR_DATA_T_mysql::ole
+SET sql_mode='NO_BACKSLASH_ESCAPES'
+/
+
+INSERT INTO KRIM_PERM_ATTR_DATA_T (ATTR_DATA_ID, OBJ_ID, VER_NBR, PERM_ID, KIM_TYP_ID, KIM_ATTR_DEFN_ID, ATTR_VAL) VALUES ('OLELOAN1001', 'OLELOAN1001', '1', 'OLELOAN1012', '56', '13', 'PatronBillMaintenanceDocument')
+/
+
+INSERT INTO KRIM_PERM_ATTR_DATA_T (ATTR_DATA_ID, OBJ_ID, VER_NBR, PERM_ID, KIM_TYP_ID, KIM_ATTR_DEFN_ID, ATTR_VAL) VALUES ('OLELOAN1002', 'OLELOAN1002', '1', 'OLELOAN1012', '56', '7', 'FALSE')
+/
+
+INSERT INTO DATABASECHANGELOG (ID, AUTHOR, FILENAME, DATEEXECUTED, ORDEREXECUTED, MD5SUM, DESCRIPTION, COMMENTS, EXECTYPE, LIQUIBASE) VALUES ('OLE_KRIM_PERM_ATTR_DATA_T_mysql', 'ole', 'org/kuali/ole/3.0.15/db.changelog-20181005.xml', NOW(), 6, '7:b165a7f0fed51e884a94a8174f9c0ecd', 'sql, loadData', '', 'EXECUTED', '3.2.0')
+/
+
 --  Release Database Lock
 --  Release Database Lock

ole-app/olefs/src/main/java/org/kuali/ole/OLEConstants.java

@@ -3945,4 +3945,17 @@ public static final class OLEPurchaseOrderBulkAmendment {
     public static final String ZERO_ENCUMBRANCE_CHECK = "ZERO_ENCUMBRANCE_CHECK";
     public static final String HOLIDAY = "Holiday";
 
+    public static final String View_Alter_Due_Date_Button ="View Alter Due Date Button";
+    public static final String View_Claims_Return_Button = "View Claims Return Button";
+    public static final String View_Replace_Copy_Button = "View Replace Copy Button";
+    public static final String View_Bill_Item_As_Lost_Button = "View Bill Item as Lost Button";
+    public static final String View_Missing_Piece_Button = "View Missing Piece Button";
+    public static final String View_Damaged_Button = "View Damaged Button";
+
+    public static final String View_Cancel_Button = "View Cancel Button";
+    public static final String View_Cancel_Credit_Button = "View Cancel Credit Button";
+    public static final String View_Error_Button = "View Error Button";
+    public static final String View_Claims_Return_Screen = "View Claims Return Screen";
+    public static final String Override_Patron_Block = "Override Patron Block";
+
 }

ole-app/olefs/src/main/java/org/kuali/ole/batch/form/OLEClaimedReturnedItemsForm.java

@@ -1,6 +1,10 @@
 package org.kuali.ole.batch.form;
 
+import org.kuali.ole.OLEConstants;
 import org.kuali.ole.deliver.bo.OLEClaimedReturnedItemResult;
+import org.kuali.rice.kim.api.permission.Permission;
+import org.kuali.rice.kim.api.services.KimApiServiceLocator;
+import org.kuali.rice.krad.util.GlobalVariables;
 import org.kuali.rice.krad.web.form.UifFormBase;
 
 import java.util.ArrayList;
@@ -14,6 +18,7 @@ public class OLEClaimedReturnedItemsForm extends UifFormBase {
     private String circulationDeskId;
     private boolean billForItem;
     private List<OLEClaimedReturnedItemResult> claimedReturnedItemResults = new ArrayList<>();
+    private boolean claimsReturnPermission;
 
     public String getCirculationDeskId() {
         return circulationDeskId;
@@ -38,4 +43,15 @@ public List<OLEClaimedReturnedItemResult> getClaimedReturnedItemResults() {
     public void setClaimedReturnedItemResults(List<OLEClaimedReturnedItemResult> claimedReturnedItemResults) {
         this.claimedReturnedItemResults = claimedReturnedItemResults;
     }
+
+    public boolean hasClaimsReturnPermission() {
+        Permission perm = KimApiServiceLocator.getPermissionService().findPermByNamespaceCodeAndName(OLEConstants.DLVR_NMSPC, OLEConstants.View_Claims_Return_Screen);
+        if (perm != null) {
+            claimsReturnPermission = KimApiServiceLocator.getPermissionService().hasPermission(GlobalVariables.getUserSession().getPerson().getPrincipalId(), OLEConstants.DLVR_NMSPC, OLEConstants.View_Claims_Return_Screen);
+            return claimsReturnPermission;
+        }
+        else {
+            return Boolean.TRUE;
+        }
+    }
 }

ole-app/olefs/src/main/java/org/kuali/ole/deliver/bo/OlePatronDocument.java

@@ -12,6 +12,7 @@
 import org.kuali.rice.kim.api.identity.email.EntityEmail;
 import org.kuali.rice.kim.api.identity.employment.EntityEmployment;
 import org.kuali.rice.kim.api.identity.phone.EntityPhone;
+import org.kuali.rice.kim.api.permission.Permission;
 import org.kuali.rice.kim.api.services.KimApiServiceLocator;
 import org.kuali.rice.kim.impl.identity.address.EntityAddressBo;
 import org.kuali.rice.kim.impl.identity.affiliation.EntityAffiliationBo;
@@ -26,6 +27,7 @@
 import org.kuali.rice.krad.bo.PersistableBusinessObjectBase;
 import org.kuali.rice.krad.service.BusinessObjectService;
 import org.kuali.rice.krad.service.KRADServiceLocator;
+import org.kuali.rice.krad.util.GlobalVariables;
 
 import java.math.BigDecimal;
 import java.text.ParseException;
@@ -110,6 +112,17 @@ public class OlePatronDocument extends PersistableBusinessObjectBase implements
     private int requestedItemRecordsCount;
     private int tempCirculationHistoryCount;
 
+    private boolean alterDueDatePermission;
+    private boolean damagedPermission;
+    private boolean missingPiecePermission;
+    private boolean billItemAsLostPermission;
+    private boolean replaceCopyPermission;
+    private boolean cancelPermission;
+    private boolean cancelCreditPermission;
+    private boolean errorPermission;
+    private boolean claimsReturnPermission;
+    private boolean overrideBlockPermission;
+
     private transient IdentityService identityService;
     private boolean lostPatron = false;
     private BusinessObjectService businessObjectService;
@@ -2102,4 +2115,120 @@ private List<ItemRecord> getItemRecords() {
         }
         return itemRecords;
     }
+
+    public boolean hasAlterDueDatePermission() {
+        Permission perm = KimApiServiceLocator.getPermissionService().findPermByNamespaceCodeAndName(OLEConstants.DLVR_NMSPC, OLEConstants.View_Alter_Due_Date_Button);
+        if (perm != null) {
+            alterDueDatePermission = KimApiServiceLocator.getPermissionService().hasPermission(GlobalVariables.getUserSession().getPerson().getPrincipalId(), OLEConstants.DLVR_NMSPC, OLEConstants.View_Alter_Due_Date_Button);
+            return alterDueDatePermission;
+        }
+        else {
+            return Boolean.TRUE;
+        }
+    }
+
+    public boolean hasReplaceCopyPermission() {
+        Permission perm = KimApiServiceLocator.getPermissionService().findPermByNamespaceCodeAndName(OLEConstants.DLVR_NMSPC, OLEConstants.View_Replace_Copy_Button);
+        if (perm != null) {
+        replaceCopyPermission = KimApiServiceLocator.getPermissionService().hasPermission(GlobalVariables.getUserSession().getPerson().getPrincipalId(), OLEConstants.DLVR_NMSPC, OLEConstants.View_Replace_Copy_Button);
+        return replaceCopyPermission;
+    }
+    else {
+        return Boolean.TRUE;
+    }
+    }
+
+    public boolean hasDamagedPermission() {
+        Permission perm = KimApiServiceLocator.getPermissionService().findPermByNamespaceCodeAndName(OLEConstants.DLVR_NMSPC, OLEConstants.View_Damaged_Button);
+        if (perm != null) {
+            damagedPermission = KimApiServiceLocator.getPermissionService().hasPermission(GlobalVariables.getUserSession().getPerson().getPrincipalId(), OLEConstants.DLVR_NMSPC, OLEConstants.View_Damaged_Button);
+            return damagedPermission;
+        }
+            else {
+                return Boolean.TRUE;
+            }
+  }
+
+    public boolean hasMissingPiecePermission() {
+        Permission perm = KimApiServiceLocator.getPermissionService().findPermByNamespaceCodeAndName(OLEConstants.DLVR_NMSPC, OLEConstants.View_Missing_Piece_Button);
+        if (perm != null) {
+
+        missingPiecePermission = KimApiServiceLocator.getPermissionService().hasPermission(GlobalVariables.getUserSession().getPerson().getPrincipalId(), OLEConstants.DLVR_NMSPC, OLEConstants.View_Missing_Piece_Button);
+        return missingPiecePermission;
+        }
+        else {
+            return Boolean.TRUE;
+        }
+    }
+
+    public boolean hasBillAsLostPermission() {
+        Permission perm = KimApiServiceLocator.getPermissionService().findPermByNamespaceCodeAndName(OLEConstants.DLVR_NMSPC, OLEConstants.View_Bill_Item_As_Lost_Button);
+        if (perm != null) {
+
+        billItemAsLostPermission = KimApiServiceLocator.getPermissionService().hasPermission(GlobalVariables.getUserSession().getPerson().getPrincipalId(), OLEConstants.DLVR_NMSPC, OLEConstants.View_Bill_Item_As_Lost_Button);
+        return billItemAsLostPermission;
+        }
+        else {
+            return Boolean.TRUE;
+        }
+    }
+
+    public boolean hasCancelPermission() {
+        Permission perm = KimApiServiceLocator.getPermissionService().findPermByNamespaceCodeAndName(OLEConstants.DLVR_NMSPC, OLEConstants.View_Cancel_Button);
+        if (perm != null) {
+
+        cancelPermission = KimApiServiceLocator.getPermissionService().hasPermission(GlobalVariables.getUserSession().getPerson().getPrincipalId(), OLEConstants.DLVR_NMSPC, OLEConstants.View_Cancel_Button);
+        return cancelPermission;
+        }
+        else {
+            return Boolean.TRUE;
+        }
+    }
+
+    public boolean hasCancelCreditPermission() {
+
+        Permission perm = KimApiServiceLocator.getPermissionService().findPermByNamespaceCodeAndName(OLEConstants.DLVR_NMSPC, OLEConstants.View_Cancel_Credit_Button);
+        if (perm != null) {
+        cancelCreditPermission = KimApiServiceLocator.getPermissionService().hasPermission(GlobalVariables.getUserSession().getPerson().getPrincipalId(), OLEConstants.DLVR_NMSPC, OLEConstants.View_Cancel_Credit_Button);
+        return cancelCreditPermission;
+        }
+        else {
+            return Boolean.TRUE;
+        }
+    }
+
+    public boolean hasErrorPermission() {
+
+        Permission perm = KimApiServiceLocator.getPermissionService().findPermByNamespaceCodeAndName(OLEConstants.DLVR_NMSPC, OLEConstants.View_Error_Button);
+        if (perm != null) {
+        errorPermission = KimApiServiceLocator.getPermissionService().hasPermission(GlobalVariables.getUserSession().getPerson().getPrincipalId(), OLEConstants.DLVR_NMSPC, OLEConstants.View_Error_Button);
+        return errorPermission;
+        }
+        else {
+            return Boolean.TRUE;
+        }
+    }
+
+    public boolean hasOverrideBlockPermission() {
+
+        Permission perm = KimApiServiceLocator.getPermissionService().findPermByNamespaceCodeAndName(OLEConstants.DLVR_NMSPC, OLEConstants.Override_Patron_Block);
+        if (perm != null) {
+            overrideBlockPermission = KimApiServiceLocator.getPermissionService().hasPermission(GlobalVariables.getUserSession().getPerson().getPrincipalId(), OLEConstants.DLVR_NMSPC, OLEConstants.Override_Patron_Block);
+            return overrideBlockPermission;
+        }
+        else {
+            return Boolean.TRUE;
+        }
+    }
+
+    public boolean hasClaimsReturnPermission() {
+        Permission perm = KimApiServiceLocator.getPermissionService().findPermByNamespaceCodeAndName(OLEConstants.DLVR_NMSPC, OLEConstants.View_Claims_Return_Screen);
+        if (perm != null) {
+            claimsReturnPermission = KimApiServiceLocator.getPermissionService().hasPermission(GlobalVariables.getUserSession().getPerson().getPrincipalId(), OLEConstants.DLVR_NMSPC, OLEConstants.View_Claims_Return_Screen);
+            return claimsReturnPermission;
+        }
+        else {
+            return Boolean.TRUE;
+        }
+    }
 }

ole-app/olefs/src/main/resources/org/kuali/ole/batch/uif/OLEClaimedReturnedItemsView.xml

@@ -99,15 +99,15 @@
                 <bean parent="Uif-SecondaryActionButton" p:style="margin-left:40%;"
                       p:actionLabel="Claims Item as Lost"
                       p:actionScript="submitForm('processBillForItem',{isBillForItem:true},null,true,function(){});"
-                      p:render="@{claimedReturnedItemResults ne null and claimedReturnedItemResults.size() > 0}"/>
+                      p:render="@{claimedReturnedItemResults ne null and claimedReturnedItemResults.size() > 0 and hasClaimsReturnPermission()}"/>
                 <bean parent="Uif-SecondaryActionButton"
                       p:actionLabel="Claims Item as Missing"
                       p:actionScript="submitForm('processBillForItem',{isBillForItem:false},null,true,function(){});"
-                      p:render="@{claimedReturnedItemResults ne null and claimedReturnedItemResults.size() > 0}"/>
+                      p:render="@{claimedReturnedItemResults ne null and claimedReturnedItemResults.size() > 0 and hasClaimsReturnPermission()}"/>
                 <bean parent="Uif-SecondaryActionButton"
                       p:actionLabel="Cancel Claims Return"
                       p:methodToCall="cancelClaimsReturn"
-                      p:render="@{claimedReturnedItemResults ne null and claimedReturnedItemResults.size() > 0}"/>
+                      p:render="@{claimedReturnedItemResults ne null and claimedReturnedItemResults.size() > 0 and hasClaimsReturnPermission()}"/>
             </list>
         </property>
     </bean>