How to authorize the store owner to duplicate product variations ? [#3105946]

There are permissions to duplicate the product type, but is there permission to duplicate product variations ?

If I am an administrator, I can duplicate the variations. But if I am a user and owner of a store, I cannot certify my variations. Why is there no permission to duplicate the variations ?

Comment	File	Size	Author
	Capture d’écran du 2020-01-12 22-58-24.png	239.28 KB	zenimagine
	Capture d’écran du 2020-01-12 22-57-49.png	256.15 KB	zenimagine

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

12 January 2020 at 21:58

zenimagine created an issue. See original summary.

Comment #2

zenimagine CreditAttribution: zenimagine commented 14 January 2020 at 22:34

Issue summary:

View changes

Comment #3

zenimagine CreditAttribution: zenimagine commented 14 January 2020 at 23:55

The only way to duplicate variations for a store owner and give him "Administer products" permission, but I can't give him that high a permission.

It would make sense that a store owner could duplicate his variations with the "[Product variations] Manage Product" permission, but that doesn't work.

Comment #4

czigor CreditAttribution: czigor at Centarro commented 15 January 2020 at 15:31

For me granting the "[Product variations] Manage Default" is enough to duplicate product variations. That's the only product permission my user has. Can you check again?

Comment #5

zenimagine CreditAttribution: zenimagine commented 15 January 2020 at 16:20

@czigor Yes this is the first thing I tried but it doesn't work. My store owner on a 403 page if he duplicates a variation.

I have the Commerce Marketplace module installed and I have the impression that it breaks a lot in Commerce since version 2.16

https://www.drupal.org/project/commerce_marketplace

It's really a shame that Commerce doesn't include authorizations for store owners.

Comment #6

czigor CreditAttribution: czigor at Centarro commented 15 January 2020 at 16:33

Commerce Marketplace does change variation access. Compare MarketplaceProductVariationAccessControlHandler::checkAccess() and ProductVariationAccessControlHandler::checkAccess(). So that might be the reason.

Can you check this on a clean Drupal Commerce install?

Comment #7

bojanz CreditAttribution: bojanz at Centarro commented 15 January 2020 at 17:00

Status:

Active

» Fixed

I can confirm that the problem is in Commerce Marketplace.

The access control handler from https://git.drupalcode.org/project/commerce_marketplace/blob/8.x-1.x/src... doesn't extend ProductVariationAccessControlHandler at all, so the "manage" permissions are never used.

Thanks, czigor!