[`Roles`] Error 403 while `issue refund` as `Guest`

Description: Guest users cannot access the refund page anymore.

Steps to reproduce the reported bug:

1. Go to any invoice under /invoices/ID as a Guest.
2. Click on Issue Refund.
3. See 403 - DENIED page.

Expected behavior:

Instead of 403 error, a guest user could issue the refund and send the link to the customer in case of a partial paid invoices

Environment:

• BTCPay Server Version: v1.4.6.0
• Deployment Method: Docker
• Browser: Chrome

[Kukks]

@pavlenex My personal preference would be to keep the functionality to create the refund as guest, since we have it before.

And you could, as you mentioned, not authorize/finalize it or (what I was doing) use a watch-only wallet

Thanks for feedback and perspective.

We have the transfer professors feature in progress which will be rolled out in the next release. This feature automatically pays out payouts awaiting payment so your last option will no longer be enough unless you use watch only wallets…

I think a store guest should be able to create a refund (pull payment) but not be able to approve payouts for them.

[pavlenex]

@kukks said he will add a permisson tag and tackle this one, later on expand it via role manager.