fix(core): Correct permissions for tax-related resolvers

packages/core/src/api/resolvers/admin/tax-category.resolver.ts

@@ -1,9 +1,9 @@
 import { Args, Mutation, Query, Resolver } from '@nestjs/graphql';
 import {
     MutationCreateTaxCategoryArgs,
+    MutationUpdateTaxCategoryArgs,
     Permission,
     QueryTaxCategoryArgs,
-    MutationUpdateTaxCategoryArgs,
 } from '@vendure/common/lib/generated-types';
 
 import { TaxCategory } from '../../../entity/tax-category/tax-category.entity';
@@ -17,7 +17,7 @@ export class TaxCategoryResolver {
     constructor(private taxCategoryService: TaxCategoryService) {}
 
     @Query()
-    @Allow(Permission.ReadSettings)
+    @Allow(Permission.ReadSettings, Permission.ReadCatalog)
     taxCategories(@Ctx() ctx: RequestContext): Promise<TaxCategory[]> {
         return this.taxCategoryService.findAll();
     }

packages/core/src/api/resolvers/admin/tax-rate.resolver.ts

@@ -19,13 +19,13 @@ export class TaxRateResolver {
     constructor(private taxRateService: TaxRateService) {}
 
     @Query()
-    @Allow(Permission.ReadSettings)
+    @Allow(Permission.ReadSettings, Permission.ReadCatalog)
     taxRates(@Ctx() ctx: RequestContext, @Args() args: QueryTaxRatesArgs): Promise<PaginatedList<TaxRate>> {
         return this.taxRateService.findAll(args.options || undefined);
     }
 
     @Query()
-    @Allow(Permission.ReadSettings)
+    @Allow(Permission.ReadSettings, Permission.ReadCatalog)
     async taxRate(@Ctx() ctx: RequestContext, @Args() args: QueryTaxRateArgs): Promise<TaxRate | undefined> {
         return this.taxRateService.findOne(args.id);
     }