[rt-users] Confusion about See/ModifyCustomField rights

[Maciej Dobrzanski]

Hello,

I am trying to troubleshoot a problem and I got a little bit confused about
how See/ModifyCustomField privileges work. Both exist as Custom Field rights
as well as Queue rights and they somehow overlap, but it's not very clear to
me how. 

With See/ModifyCustomField set for a group on a queue, I can see and edit
custom fields for any tickets in that queue, but at the same time I can't
see the same custom fields in search edit - even after selecting a queue
first. With See/ModifyCustomField granted for the same group in the custom
field properties, on the other hand, 
RT will show it in search options.

It seems like a similar difference exists in API. With queue rights I can
access and iterate on $Ticket->CustomFields, but creating a custom field
object instance and loading one of the same custom fields by queue and name
fails unless the user has See/Modify rights on the actual field.

Could someone explain how these rights really work?

Best regards,
Maciek