View only customers permissions not being carried into Transactions. Bug?

[nell_a]

View only customers permissions not being carried into Transactions. Bug?

Hi @tranguyen 

I've noticed if a user's Customers permissions is set to view-only rights, he can still edit Customers if he accesses them via Transactions. This is therefore a loophole that requires closing. Please inform your product team.

Thank you

[tranguyen]

Hi @nell_a, thanks for flagging this! 

I'm testing out a few things on my end and I would like to get a bit more information to make sure I'm not missing anything and so that I can raise this to the appropriate team for it to be resolved as well. Can you let me know:

• Is this happening when the Team Member view Transactions on their Dashboard or within the Square Point of Sale app?
• Within their permission for Customers, aside from View customers, is there anything else that's ticked for them?
• Aside from Customers, are they granted any other permission?

For context, when I test this on my end, I create a team member profile who only has the ability to view all completed sales transactions from all team members and view customers. Under this permission, I wasn't able to see any customer information when viewing Transactions on Dashboard. I was able to add a customer to sale when ringing up a payment on the Square Point of Sale app, but it ask me for a four-digit code if I try to tap the edit button, and all the information were blanked out. As such, I want to double-check with you to be sure I can reproduce this issue and flag it.