diff --git a/src/IncludeResolver.php b/src/IncludeResolver.php index 94cf842..7046c6c 100644 --- a/src/IncludeResolver.php +++ b/src/IncludeResolver.php @@ -8,6 +8,7 @@ use Drupal\Core\Entity\FieldableEntityInterface; use Drupal\Core\Field\Plugin\Field\FieldType\EntityReferenceItem; use Drupal\jsonapi\Context\FieldResolver; use Drupal\jsonapi\Controller\EntityResource; +use Drupal\jsonapi\Exception\EntityAccessDeniedHttpException; use Drupal\jsonapi\JsonApiResource\EntityCollection; use Drupal\jsonapi\ResourceType\ResourceType; @@ -103,7 +104,10 @@ class IncludeResolver { } $field_list = $entity->get($field_name); // @todo: raise an omitted item to an inaccessible related field in https://www.drupal.org/project/jsonapi/issues/2956084. - if (!$field_list->access('view')) { + $field_access = $field_list->access('view', NULL, TRUE); + if (!$field_access->isAllowed()) { + $message = 'The current user is not allowed to view this relationship.'; + $includes = EntityCollection::merge($includes, new EntityCollection([new EntityAccessDeniedHttpException($entity, $field_access, '', $message)])); continue; } $target_type = $field_list->getFieldDefinition()->getFieldStorageDefinition()->getSetting('target_type');