I'd like visitors to see my synonyms, but not administer them

If you install jsonapi and visit /jsonapi/search_api_synonym/search_api_synonym

You'll see a message:

"The current user is not allowed to GET the selected resource. The 'administer search api synonyms' permission is required."

I'd like to give anonymous users a permission to "view synonyms" and have anonymous users be able to visit /jsonapi/search_api_synonym/search_api_synonym and view synonyms without requiring them to have the administer synonyms permission.

CommentFileSizeAuthor
#7 img04.png91.34 KBbrandonlira
#7 img03.png133.95 KBbrandonlira
#7 img02.png57.63 KBbrandonlira
#7 img01.png51.54 KBbrandonlira
Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

alberto56 created an issue. See original summary.

aaron.ferris’s picture

Version: 8.x-1.x-dev » 3.0.x-dev
Assigned: Unassigned » aaron.ferris

aaron.ferris’s picture

Assigned: aaron.ferris » Unassigned
Status: Active » Needs review
aaron.ferris’s picture

Added a permission/entity view hook for this.

Example jsonapi response with an anonymous user, with access to view

{"jsonapi":{"version":"1.0","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.0\/"}}}},"data":[{"type":"search_api_synonym--search_api_synonym","id":"abb09e71-552d-4ad0-bf75-804b0e969469","links":{"self":{"href":"https:\/\/drupal-11.ddev.site\/jsonapi\/search_api_synonym\/search_api_synonym\/abb09e71-552d-4ad0-bf75-804b0e969469"}},"attributes":{"drupal_internal__sid":4,"langcode":"en","search_api_synonym_type":"spelling_error","word":"marmelade","synonyms":"marmalade,mermelad,marmellade","status":true,"created":"2025-04-27T13:01:40+00:00","changed":"2025-04-27T13:01:40+00:00","field_asddsadasd":null},"relationships":{"uid":{"data":{"type":"user--user","id":"1f83400a-0892-4ed0-99b3-1379d9c831b3","meta":{"drupal_internal__target_id":1}},"links":{"related":{"href":"https:\/\/drupal-11.ddev.site\/jsonapi\/search_api_synonym\/search_api_synonym\/abb09e71-552d-4ad0-bf75-804b0e969469\/uid"},"self":{"href":"https:\/\/drupal-11.ddev.site\/jsonapi\/search_api_synonym\/search_api_synonym\/abb09e71-552d-4ad0-bf75-804b0e969469\/relationships\/uid"}}}}}],"links":{"self":{"href":"https:\/\/drupal-11.ddev.site\/jsonapi\/search_api_synonym\/search_api_synonym"}}}

aaron.ferris’s picture

Testing steps

1. Enable this module
2. Enable jsonapi
3. Assign the new permission view search api synonyms to relevant roles
4. Go to /jsonapi/search_api_synonym/search_api_synonym

Expected: if the user has the permission, they should be able to view the synonyms as json

1. Remove the permission from the same roles
2. Go to /jsonapi/search_api_synonym/search_api_synonym

Expected: The synonyms should not be viewable (we should see the same response from the original ticket description).

brandonlira’s picture

Status: Needs review » Reviewed & tested by the community
StatusFileSize
new51.54 KB
new57.63 KB
new133.95 KB
new91.34 KB

Hi @aaron.ferris

Manually tested MR !25.

  • Confirmed the issue initially: anonymous users received `The 'administer search api synonyms' permission is required` when accessing `/jsonapi/search_api_synonym/search_api_synonym`.
  • Checked out the MR !25 branch locally.
  • Created two synonym entries (one regular synonym and one spelling error) to test.
  • Granted the new permission `View search api synonyms` to the Anonymous role.
  • Retested the endpoint as an anonymous user.
  • Synonym entities were successfully returned in the JSON:API response.
  • Removing the permission again blocks access as expected.
aaron.ferris’s picture

Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.