=== modified file 'uc_attribute/uc_attribute.module'
--- uc_attribute/uc_attribute.module	2009-02-19 18:24:12 +0000
+++ uc_attribute/uc_attribute.module	2009-03-02 21:19:51 +0000
@@ -54,7 +54,7 @@
       'path' => 'admin/store/products/attributes',
       'title' => t('Manage attributes'),
       'description' => t('Create and edit attributes and options.'),
-      'access' => user_access('administer products'),
+      'access' => user_access('administer attributes'),
       'callback' => 'uc_attribute_admin',
       'type' => MENU_NORMAL_ITEM,
       'weight' => -1,
@@ -68,7 +68,7 @@
     $items[] = array(
       'path' => 'admin/store/products/attributes/add',
       'title' => t('Add an attribute'),
-      'access' => user_access('administer products'),
+      'access' => user_access('administer attributes'),
       'callback' => 'drupal_get_form',
       'callback arguments' => array('uc_attribute_form'),
       'type' => MENU_LOCAL_TASK,
@@ -78,7 +78,7 @@
       'path' => 'admin/store/settings/attributes',
       'title' => t('Attribute settings'),
       'description' => t('Configure the attribute settings'),
-      'access' => user_access('administer products'),
+      'access' => user_access('administer attributes'),
       'callback' => 'drupal_get_form',
       'callback arguments' => array('uc_attribute_admin_settings'),
       'type' => MENU_NORMAL_ITEM,
@@ -89,14 +89,14 @@
       $items[] = array(
         'path' => 'admin/store/products/attributes/'. arg(4) .'/edit',
         'title' => t('Edit attribute'),
-        'access' => user_access('administer products'),
+        'access' => user_access('administer attributes'),
         'callback' => 'drupal_get_form',
         'callback arguments' => array('uc_attribute_form', arg(4)),
         'type' => MENU_CALLBACK,
       );
       $items[] = array(
         'path' => 'admin/store/products/attributes/'. arg(4) .'/delete',
-        'access' => user_access('administer products'),
+        'access' => user_access('administer attributes'),
         'callback' => 'drupal_get_form',
         'callback arguments' => array('uc_attribute_delete_confirm', arg(4)),
         'type' => MENU_CALLBACK,
@@ -104,7 +104,7 @@
       $items[] = array(
         'path' => 'admin/store/products/attributes/'. arg(4) .'/options',
         'title' => t('Options'),
-        'access' => user_access('administer products'),
+        'access' => user_access('administer attributes'),
         'callback' => 'uc_attribute_options',
         'callback arguments' => array(arg(4)),
         'type' => MENU_CALLBACK,
@@ -118,7 +118,7 @@
       $items[] = array(
         'path' => 'admin/store/products/attributes/'. arg(4) .'/options/add',
         'title' => t('Add an option'),
-        'access' => user_access('administer products'),
+        'access' => user_access('administer attributes'),
         'callback' => 'drupal_get_form',
         'callback arguments' => array('uc_attribute_option_form', arg(4), NULL),
         'type' => MENU_LOCAL_TASK,
@@ -127,6 +127,7 @@
       $items[] = array(
         'path' => 'admin/store/products/attributes/'. arg(4) .'/options/'. arg(6) .'/edit',
         'title' => t('Edit option'),
+        'access' => user_access('administer attributes'),
         'callback' => 'drupal_get_form',
         'callback arguments' => array('uc_attribute_option_form', arg(4), arg(6)),
         'type' => MENU_CALLBACK,
@@ -134,6 +135,7 @@
       $items[] = array(
         'path' => 'admin/store/products/attributes/'. arg(4) .'/options/'. arg(6) .'/delete',
         'title' => t('Delete option'),
+        'access' => user_access('administer attributes'),
         'callback' => 'drupal_get_form',
         'callback arguments' => array('uc_attribute_option_delete_confirm', arg(4), arg(6)),
         'type' => MENU_CALLBACK,
@@ -144,6 +146,7 @@
     $items[] = array(
       'path' => 'admin/store/products/classes/'. arg(4) .'/attributes',
       'title' => t('Attributes'),
+      'access' => uc_attribute_product_class_access(),
       'callback' => 'drupal_get_form',
       'callback arguments' => array('uc_object_attributes_form', arg(4), 'class'),
       'weight' => 1,
@@ -152,6 +155,7 @@
     $items[] = array(
       'path' => 'admin/store/products/classes/'. arg(4) .'/options',
       'title' => t('Options'),
+      'access' => uc_attribute_product_class_access(),
       'callback' => 'drupal_get_form',
       'callback arguments' => array('uc_object_options_form', arg(4), 'class'),
       'weight' => 2,
@@ -164,6 +168,7 @@
       if ($node->nid && in_array($node->type, module_invoke_all('product_types'))) {
         $items[] = array('path' => 'node/'. arg(1) .'/edit/attributes',
           'title' => t('Attributes'),
+          'access' => uc_attribute_product_access(arg(1)),
           'callback' => 'drupal_get_form',
           'callback arguments' => array('uc_object_attributes_form', arg(1), 'product', 'overview'),
           'weight' => 1,
@@ -171,6 +176,7 @@
         );
         $items[] = array('path' => 'node/'. arg(1) .'/edit/attributes/add',
           'title' => t('Attributes'),
+          'access' => uc_attribute_product_access(arg(1)),
           'callback' => 'drupal_get_form',
           'callback arguments' => array('uc_object_attributes_form', arg(1), 'product', 'add'),
           'weight' => 1,
@@ -178,6 +184,7 @@
         );
         $items[] = array('path' => 'node/'. arg(1) .'/edit/options',
           'title' => t('Options'),
+          'access' => uc_attribute_product_option_access(arg(1)),
           'callback' => 'drupal_get_form',
           'callback arguments' => array('uc_object_options_form', arg(1), 'product'),
           'weight' => 2,
@@ -185,6 +192,7 @@
         );
         $items[] = array('path' => 'node/'. arg(1) .'/edit/adjustments',
           'title' => t('Adjustments'),
+          'access' => uc_attribute_product_option_access(arg(1)),
           'callback' => 'drupal_get_form',
           'callback arguments' => array('uc_product_adjustments_form', arg(1)),
           'weight' => 3,
@@ -198,6 +206,30 @@
 }
 
 /**
+ * Helper function for handling menu access.
+ */
+function uc_attribute_product_class_access() {
+  return user_access('administer product classes') && user_access('administer attributes');
+}
+
+function uc_attribute_product_access($nid) {
+  $node = node_load($nid);
+   if ($node->type == 'product_kit') {
+     return FALSE;
+   }
+  return uc_product_is_product($node) && node_access('update', $node) && (user_access('administer attributes') || user_access('administer product attributes'));
+}
+
+function uc_attribute_product_option_access($nid) {
+  $node = node_load($nid);
+  return uc_product_is_product($node) && node_access('update', $node) && (user_access('administer attributes') || user_access('administer product attributes') || user_access('administer product options'));
+}
+
+function uc_attribute_perm() {
+  return array('administer attributes', 'administer product attributes', 'administer product options');
+}
+
+/**
  * Implementation of hook_form_alter().
  *
  * Attach option selectors to the form with the "Add to Cart" button.