Why do you need create record valve permission to getList('search?' + queryString)?

[Jeffrey Layanto]

For a user to call ds.record.getList('search?' + queryString), that user needs create record permission. Why?

My initial expectation was:

1. User call ds.record.getList('search?' + queryString)
2. Search provider does the query and create the list (search provider needs create record permission)
3. User gets the created list and subscribes to it (user needs read record permission)

Is this not the case?

[Jeffrey Layanto]

I believe the sequence of events is:

1. User call ds.record.getList('search?' + queryString) which creates the list/record hence needing create record permission
2. Search provider does the query and populate the already created list (search provider needs create record permission)
3. User gets notified of updated list

I created a valve permission rule for search so even if client does not have create record permission in general, it has create record permission for search.