search

saleor / saleor

Saleor Core: the high performance, composable, headless commerce API.
https://saleor.io
BSD 3-Clause "New" or "Revised" License
20.81k stars 5.51k forks source link

Bug: Permissions ignored in Promotions query #16484

Open supersilverlemonhaze opened 3 months ago

supersilverlemonhaze commented 3 months ago

What are you trying to achieve?

Using a token from my admin account to query promotions just like i query other protected stuff yields the "To access this path, you need one of the following permissions: MANAGE_DISCOUNTS", error. I verified through the UI that I have the permissions on my account.

Steps to reproduce the problem

Create fresh saleor instance w version 3.20, only things i changed was i added new shipping zone and channel. Its supposed to work regardless

What did you expect to happen?

That i can manage the discounts when i have the proper permissions ....

Logs

No response

Environment

Saleor version: 3.20, same w dashboard OS and version: …

korycins commented 3 months ago

Checked this with 3.20, and I am getting a correct results: user with manage_discounts is able to fetch promotions image User without manage_discounts receives permission error: image

Make sure, that you're using a correct token, or provide more details like:

    me{
        userPermissions{
            code
        }
        permissionGroups{
            permissions{
                code
            }
        }
    }

Some screenshots, and details of what type of auth layer you're using - is it built-in one? OIDCPlugin with SSO/without SSO?