Repository: saleor/saleor

Issue:
Managing products require more permissions than "Manage products"
A staff member with only the "Manage products" permissions gets an unexpected error when creating a new product from the saleor dashboard. A `PermissionDenied` exception related to `quantityAllocated` is raised on submit. However, the product seems successfully created behind the scene.

Navigating to a product also raises errors related to `quantityAllocated`.

## Workaround
The issue does not occurs when the staff member also has the "Manage orders" permission.

## Versions
Saleor: master (docker setup)
Saleor-dashboard: master

## Annex
Request/response data: https://gist.github.com/simonbru/2cde1e0cf080cdcdd961bd61114cf843




Discussion:
@simonbru Hey! We are aware of this issue. Our holiday season has just finished, so we have a lot of work to do for now. Once we have more free time, we'll try to fix it. Thanks for your patience and understanding. 
`quantityAllocated` and two other fields in the `Product` type require both permissions. But to be honest I think this could be changed to require only `MANAGE_PRODUCTS` in those cases.

Resolving patch:
diff --git a/saleor/graphql/product/schema.py b/saleor/graphql/product/schema.py
--- a/saleor/graphql/product/schema.py
+++ b/saleor/graphql/product/schema.py
@@ -1,6 +1,6 @@
 import graphene
 
-from ...core.permissions import OrderPermissions, ProductPermissions
+from ...core.permissions import ProductPermissions
 from ..core.enums import ReportingPeriod
 from ..core.fields import FilterInputConnectionField, PrefetchingConnectionField
 from ..decorators import permission_required
@@ -279,9 +279,7 @@ def resolve_product_variant(self, info, id):
     def resolve_product_variants(self, info, ids=None, **_kwargs):
         return resolve_product_variants(info, ids)
 
-    @permission_required(
-        [OrderPermissions.MANAGE_ORDERS, ProductPermissions.MANAGE_PRODUCTS]
-    )
+    @permission_required(ProductPermissions.MANAGE_PRODUCTS)
     def resolve_report_product_sales(self, *_args, period, **_kwargs):
         return resolve_report_product_sales(period)
 
diff --git a/saleor/graphql/product/types/products.py b/saleor/graphql/product/types/products.py
--- a/saleor/graphql/product/types/products.py
+++ b/saleor/graphql/product/types/products.py
@@ -9,7 +9,7 @@
 from graphene_federation import key
 from graphql.error import GraphQLError
 
-from ....core.permissions import OrderPermissions, ProductPermissions
+from ....core.permissions import ProductPermissions
 from ....product import models
 from ....product.templatetags.product_images import (
     get_product_image_thumbnail,
@@ -326,25 +326,19 @@ def resolve_quantity(root: models.ProductVariant, *_args):
         return root.quantity
 
     @staticmethod
-    @permission_required(
-        [OrderPermissions.MANAGE_ORDERS, ProductPermissions.MANAGE_PRODUCTS]
-    )
+    @permission_required(ProductPermissions.MANAGE_PRODUCTS)
     def resolve_quantity_ordered(root: models.ProductVariant, *_args):
         # This field is added through annotation when using the
         # `resolve_report_product_sales` resolver.
         return getattr(root, "quantity_ordered", None)
 
     @staticmethod
-    @permission_required(
-        [OrderPermissions.MANAGE_ORDERS, ProductPermissions.MANAGE_PRODUCTS]
-    )
+    @permission_required(ProductPermissions.MANAGE_PRODUCTS)
     def resolve_quantity_allocated(root: models.ProductVariant, *_args):
         return root.quantity_allocated
 
     @staticmethod
-    @permission_required(
-        [OrderPermissions.MANAGE_ORDERS, ProductPermissions.MANAGE_PRODUCTS]
-    )
+    @permission_required(ProductPermissions.MANAGE_PRODUCTS)
     def resolve_revenue(root: models.ProductVariant, *_args, period):
         start_date = reporting_period_to_date(period)
         return calculate_revenue_for_variant(root, start_date)


Test patch: