product variation not viewable/editable by content-authors

[sparkcom]

the canEdit / canDelete / canCreate/canView methods need to be defined in the Variation class as content-authors can't work on variation. Currently a way to work around it is to set the permissions using an extension

[bummzack]

That is a general SilverStripe "issue" or limitation. DataObjects can never be edited by non-admins if permissions aren't explicitly granted.

Not sure if we should introduce explicit permissions for variations (eg. that editing of variations can be granted to a group of users), or if the permissions should just be inherited from the parent Product?
I'm leaning towards the latter approach. Thoughts?

[sparkcom]

The latter approach to inherit permissions from parent Product is logical.

There is the same issue with Attribute and AttributeValue. PermissionProvider may be a good solution for them.