Due to user promote a parent build to another configuration (diffirent with rebuild) and user need call API build request at that configuration. User allowed to promote build at parent configuration but can not trigger directly dest configuration. And trigger through api is a request to dest configuration.
it seems only check run build permission.
I mean when users trigger promote build use REST API:
In the promotion build configuration where the user does not have trigger permission but on the root configuration it has permission so they can not trigger it.
I think we should check more conditions to allow the api to do what promote build manually.
How do you think ?