Skip to content

Add missing default permissions for Store manager role on install#739

Open
KrzysztofPajak wants to merge 1 commit into
developfrom
fix/store-manager-default-permissions
Open

Add missing default permissions for Store manager role on install#739
KrzysztofPajak wants to merge 1 commit into
developfrom
fix/store-manager-default-permissions

Conversation

@KrzysztofPajak

Copy link
Copy Markdown
Member

Summary

  • Store owner (StoreManager customer group) functionality in Grand.Web.Store grew significantly (per-store Customers, Settings, Payment methods/settings/restrictions, Customer/Address/Contact attributes, Shipping, Tax, Currencies, Discounts, Gift vouchers, Languages, Email accounts, Message templates, Pages), but the default permission set granted to that role at install time was never updated.
  • As a result, a freshly installed Store manager account could not reach these newer store-owner controllers/actions, even though ManageAccessStoreManagerPanel (the panel gate) was already granted.
  • Adds the 15 corresponding StandardPermission entries to the StoreManager block in PermissionExtensions.DefaultPermissions().
  • Scope is intentionally install-time only — no migration of existing installations, so stores that already customized Store manager permissions are left untouched.
  • Deliberately excluded: ManageDocuments (Documents tab is intentionally hidden for store managers), ManagePlugins and ManageMessageQueue (system-level/global concerns, not per-store).

Test plan

  • Fresh install and verify a Store manager account can access Customers, Settings, Payment, Customer/Address/Contact Attributes, Shipping, Tax, Currencies, Discounts, Gift Vouchers, Languages, Email Accounts, Message Templates, Pages under /Store
  • Verify Documents tab remains hidden and Plugins/global Message Queue remain inaccessible for Store manager
  • Verify existing installations are unaffected (no permission changes for already-provisioned customer groups)

New Grand.Web.Store controllers (Customers, Settings, Payment,
Customer/Address/Contact attributes, Shipping/Tax, Currencies,
Discounts, Gift vouchers, Languages, Email accounts, Message
templates, Pages) were never reflected in the default permission
set granted to the Store manager customer group during installation,
so freshly installed store owners could not reach them. Only affects
new installations; existing installs are not migrated.
Copilot AI review requested due to automatic review settings July 18, 2026 19:31

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants