BUG: Multicurrency API does not consider user's write permission

[iantun-x]

Bug

Even when user has the necessary permissions, API does not allow modifications on currency or rate.
I think I found the issue, I will submit a pull request shortly.

Environment Version

18.0.5

Environment OS

AlmaLinux 9

Environment Web server

Apache 2.4

Environment PHP

8.1

Environment Database

Mariadb 10.3.39

Environment URL(s)

No response

Expected and actual behavior

Expected results:

Response with successfully updated rate, as in this example:

{
"id": "2",
"name": "Euros (€)",
"code": "EUR",
"rate": {
"id": 11,
"rate": "1.01",
"date_sync": 1708196305
}
}

Actual results:

Response with error:

{
"error": {
"code": 401,
"message": "Unauthorized: Insufficient rights to update currency rate"
},
"debug": {
"source": "api_multicurrencies.class.php:311 at call stage",
"stages": {
"success": [
"get",
"route",
"negotiate",
"authenticate",
"validate"
],
"failure": [
"call",
"message"
]
}
}
}

Steps to reproduce the behavior

Enable multicurrency.
Create one currency other than the main currency. We'll assume it will receive ID = 2.
Create a user, non-administrator, and give it all permissions on module Multicurrency, and nothing else other than the default.
Give user an API Key.

The attached PHP script (issue.php) allows to reproduce the issue.

Attached files

issue.zip

[Hystepik]

It seems to be fixed so I close the issue.
Feel free to reopen if not.