I have seen the documentation for Gerrit's check.access API, but it does not seem to work at all as described when trying it out with the gerritcodereview/gerrit:2.15.2 docker image.

For example, the documentation says that if I pass permission, I must pass a ref. This doesn't seem to be the case at all. I am able to POST the following body:

{
  "account": "admin",
  "permission": "read"
}

And it happily returns a { status: 200 } response. The source code for check access seems to tell me that this should not be the behaviour, so I can't understand why it works this way. The only time this API returns a 403 is if I explicitly disallow the read permission on a project. I cannot seem to make the check work for any other permission, like push for example.

All I am really trying to do is to figure out whether a given Gerrit user has a specific permission on a ref. What is the right way to get this information from Gerrit?