Problem/Motivation

Currently, for both the GET/PATCH methods for the checkout resource, we require the commerce_order.update entity access.

We should require commerce_order.view for GET, and commerce_order.update for PATCH so that one can request the checkout resource once the order is placed.

Issue fork commerce_api-3180938

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

jsacksick created an issue. See original summary.

mglaman’s picture

mglaman
Primary language English
Location WI, USA
commented

+1. Each HTTP method for a path can be its own route definition. JSON:API does this to have different controller methods for POST/PATCH/DELETE/GET on relationships

jsacksick opened merge request !31

  • jsacksick committed edca3f5f on 8.x-1.x 
    [#3180938] feat: The checkout GET route should have commerce_order.view...
jsacksick’s picture

jsacksick commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.