User is unable to create API key for a private channel when role is set to member

[dcseal2]

Problem Scenario

User overlord has a private channel "priv-channel" and would like to grant read access to for another user bob, but does not want bob to be able to upload content, just search and download. User overlord logs into the WebUI, naviates to the swagger UI and then uses the /api/channels/{channel_name}/members endpoint to add user bob to "priv-channel" with "role" : "member". User overlord then verifies that bob is listed as a member of that channel by inspecting the output of the /api/users/{username}/channels endpoint. Now bob logs into and verifies he can see the channel by using the WebUI. He's in fact able to download packages by clicking on the package name, however the POST /api/api-keys endpoing returns a 403 Error: Forbidden when trying to create an API key using "role": :"member".

Summary

In short, after adding another user to a private channel with role set to "member", that user can download packages manually using the WebUI but is unable to create an API key for that channel which is needed to be able to access anything using a CLI utility.