Hey, folks - I've got a strange question that I feel like should be simple, but yet... One of our product team is trying to add products to a promotion, and is unable to search for the products. She gets an authorization failure. I, on the other hand, am able to search just fine. I dug in, and it seems like this is a permissions issue. The promotions page hits

/admin/search/products

to issue a search for these products, and that is returning an auth failure for this user. Because I'm a super user, it allows me to proceed. But after much digging, I still can't quite wrap my head around what permissions I need to actually grant this user to enable this use case. It looks like the permission check is coming from the

authorize_admin

method of the BaseController. That method looks like the following:

def authorize_admin
        if respond_to?(:model_class, true) && model_class
          record = model_class
        else
          record = controller_name.to_sym
        end
        authorize! :admin, record
        authorize! action, record
      end

In my case after tracing this,

record

is

product

and

action

is

search

- and the

authorize! :admin

line is failing. The user has the ProductMangement permission set, though, which grants

:manage SpreeProduct

. So what additional permission do I need to grant this user to perform a product search?

did you check that her user has api_key ?

I'm about 90% sure she does - but let me confirm that real quick.