ensure permission erros knock through

src/backend/InvenTree/InvenTree/models.py

@@ -8,7 +8,7 @@ from typing import Any, Optional
 from django.contrib.auth import get_user_model
 from django.contrib.contenttypes.fields import GenericRelation
 from django.contrib.contenttypes.models import ContentType
-from django.core.exceptions import PermissionDenied, ValidationError
+from django.core.exceptions import ValidationError
 from django.db import models, transaction
 from django.db.models import QuerySet
 from django.db.models.signals import post_save
@@ -23,6 +23,7 @@ from django_q.models import Task
 from error_report.models import Error
 from mptt.exceptions import InvalidMove
 from mptt.models import MPTTModel, TreeForeignKey
+from rest_framework.exceptions import PermissionDenied
 from stdimage.models import StdImageField
 from taggit.managers import TaggableManager
 

src/backend/InvenTree/plugin/base/barcodes/api.py

@@ -154,6 +154,8 @@ class BarcodeView(CreateAPIView):
         for current_plugin in plugins:
             try:
                 result = current_plugin.scan(barcode, user=request.user, **kwargs)
+            except PermissionDenied as exc:
+                raise exc
             except Exception:
                 log_error('BarcodeView.scan_barcode', plugin=current_plugin.slug)
                 continue

src/backend/InvenTree/plugin/base/barcodes/test_barcode.py

@@ -345,10 +345,14 @@ class SOAllocateTest(InvenTreeAPITestCase):
         # Test with barcode which points to a *part* instance
         item.part.assign_barcode(barcode_data='abcde')
 
+        # missing permission for viewing the part - error
+        self.postBarcode('abcde', sales_order=self.sales_order.pk, expected_code=403)
+
+        # Add part.view role and test again
+        self.assignRole('part.view')
         result = self.postBarcode(
             'abcde', sales_order=self.sales_order.pk, expected_code=400
         )
-
         self.assertIn('does not match an existing stock item', str(result['error']))
 
     def test_submit(self):