Move uses of Shortcut from Jsonapi to Shortcut

Working on this...

Hi,
Posted an update that moves the shortcut-specific JSON:API filter access logic into shortcut: jsonapi_shortcut_filter_access() now lives in ShortcutHooks, and a new jsonapi_shortcut_filter_query_access_alter() implementation enforces the current user’s displayed shortcut_set. On the jsonapi side, I added a small prefix-aware filter query alter hook and updated TemporaryQueryGuard to invoke it, which allowed removing the hard-coded shortcut special case and the old shortcut hook from JsonapiHooks.

This one will really need an IS update. I'm not sure we should be adding a new api and static method for json to remove a module.

Late here but pushed a potential alternative though it is failing but doesn't require an API change. @catch should receive credit too.

Am wondering if an alter hook would be cleaner though.

Working on getting an answer about preferred approach.

Thanks @smustgrave, that makes sense.

My reason for adding the new hook/static helper was that the shortcut restriction is path-aware in JSON:API filtered queries, and I was trying to let shortcut own both the permission check and the query restriction without leaving shortcut-specific logic in jsonapi.

That said, I agree that adding a new jsonapi API just to move module-owned code is probably too heavy if an existing alter/query-access hook can cover it cleanly. If the approach in !15264 or a similar alter-hook-based solution works, I’m happy to rework toward that instead of introducing new API surface.

Not sure 2 APIs are needed but having one at the end of that switch statement does seem to make sense. Still working to get an answer. Will keep you updated.

Thanks,
looking forward, how we'll end up with this.

Discussed with @smustgrave on Slack, then pointed Claude Code in the right direction from what I learned from the discussion. MR!15329 seems to make sense in terms of moving the filtering entirely to shortcut module; hook_jsonapi_shortcut_filter_access moves directly, and the TemporaryQueryGuard code becomes hook_query_shortcut_access_alter as per the documentation in TemporaryQueryGuard. ShortcutTest passes locally.

Thanks so much @longwave you're a rockstar for figuring that out!

I pushed 1 small tweak to a comment in the test that was flagged in another MR.

Thanks @longwave & @smustgrave for digging into this and for sharing the alternative approach.

After comparing the two MRs, !15329 looks like the better fit for core. It moves the shortcut-specific logic out of jsonapi without adding new JSON:API API surface, and it follows the existing TemporaryQueryGuard/jsonapi.api.php guidance by using hook_jsonapi_shortcut_filter_access() plus hook_query_shortcut_access_alter() for the query narrowing.

I understand, earlier approach in !15234 worked, but it introduced a new API and helper method just to move one module’s logic, which is a bigger change than this issue likely needs. The narrower approach in !15329 seems more maintainable and easier to review.

Committed and pushed b4c833bf0fd to main and 9172c7e3157 to 11.x. Thanks!