Entity API 8.x-1.8 (SA-CONTRIB-2026-113) stopped granting JSONAPI_FILTER_AMONG_ALL to entity types whose query access returns no conditions. The Entity API maintainers say in #3619403 that the module providing the entity type should declare its filter access. Commerce does this for orders and product variations, but not for commerce_product_attribute_value. As a result, any ?filter= on attribute values, or on products through variations.attribute_*, returns no results for non-admin users.
Proposed fix: add a jsonapi_commerce_product_attribute_value_filter_access hook to CommerceProductHooks granting JSONAPI_FILTER_AMONG_ALL when the user has access content. That matches ProductAttributeValueAccessControlHandler. Attribute values have no published or owner key, so "among all" is the only subset that applies.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | commerce-3634146-2-test-only.patch | 4.3 KB | thenchev |
| #2 | commerce-3634146-2.patch | 5.37 KB | thenchev |
Comments
Comment #2
thenchev commented