Entity API 8.x-1.8 (SA-CONTRIB-2026-113) stopped granting JSONAPI_FILTER_AMONG_ALL to entity types whose query access returns no conditions. The Entity API maintainers say in #3619403 that the module providing the entity type should declare its filter access. Commerce does this for orders and product variations, but not for commerce_product_attribute_value. As a result, any ?filter= on attribute values, or on products through variations.attribute_*, returns no results for non-admin users.

Proposed fix: add a jsonapi_commerce_product_attribute_value_filter_access hook to CommerceProductHooks granting JSONAPI_FILTER_AMONG_ALL when the user has access content. That matches ProductAttributeValueAccessControlHandler. Attribute values have no published or owner key, so "among all" is the only subset that applies.

Comments

thenchev created an issue. See original summary.

thenchev’s picture

Status: Active » Needs review
StatusFileSize
new5.37 KB
new4.3 KB