admin-api activeChannel Query Returns "FORBIDDEN" for Logged-in Users

[yazfield]

Describe the bug
First of all, not sure if this is a bug or I'm missing something.
I'm trying to login using the admin-api and perform some queries as a seller account and show his channel information.
The ActiveChannel query returns a "You are not currently authorized to perform this action" (FORBIDDEN) error unless the user is logged in as an administrator.

So this prevents seller users from retrieving their active channel, even if they are authenticated and assigned to a channel.

To Reproduce
Steps to reproduce the behavior:

Log in using the login mutation with valid seller scredentials:

mutation Login {
  login(username: "[email protected]", password: "123123") {
    ...on CurrentUser {
      id
      identifier
    }
    ...on ErrorResult {
      errorCode
      message
    }
  }
}

Response:

{
  "data": {
    "login": {
      "id": "2",
      "identifier": "[email protected]"
    }
  }
}

Attempt to fetch the active channel using the ActiveChannel query:

query ActiveChannel {
  activeChannel {
    id
  }
}

Response:

{
  "errors": [
    {
      "message": "You are not currently authorized to perform this action",
      "locations": [
        {
          "line": 28,
          "column": 3
        }
      ],
      "path": ["activeChannel"],
      "extensions": {
        "code": "FORBIDDEN"
      }
    }
  ],
  "data": null
}

Expected behavior
The ActiveChannel query should return the active channel for any authenticated user, not only for administrators.

Environment (please complete the following information):

• @vendure/core version: 3.0.4
• Nodejs version v20.8.1
• Database (mysql/postgres etc):postgres

Additional context

I want to build an admin panel for the sellers in a multi vendor setup, i need channel information of currently logged in user

[yazfield]

After investigating i found that in admin-ui the mutation SetActiveChannel is called

mutation SetActiveChannel($channelId: ID!) {
    setActiveChannel(channelId: $channelId) @client {
        ...UserStatus
    }
}

i tried to use it on admin-api playground and got this error saying the mutation doesn't exist:

{
  "error": {
    "errors": [
      {
        "message": "Cannot query field \"setActiveChannel\" on type \"Mutation\". Did you mean \"createChannel\", \"deleteChannel\", \"updateChannel\", or \"deleteChannels\"?",
        "locations": [
          {
            "line": 73,
            "column": 3
          }
        ],
        "extensions": {
          "http": {
            "status": 400,
            "headers": {}
          },
          "code": "GRAPHQL_VALIDATION_FAILED"
        }
      }
    ]
  }
}