Describe your bug or feature request.

After the security fixes in 3.3.13 I can no longer use filters on product variations in the JSON:API even if the account has permission to view unpublished variations (via the 'manage {bundle} commerce_product_variation' permission).
The account can still view the unpublished variations via the JSON:API. But if it uses a filter to search variations then any unpublished ones are omitted from the list.

If a bug, provide steps to reproduce it from a clean install.

  1. Enable JSON:API on the site.
  2. Create some products and variations. Unpublish some of those variations.
  3. Assign an account the 'manage {bundle} commerce_product_variation' permission.
  4. Login to that account.
  5. Visit the JSON:API endpoint and try to find an unpublished variation's SKU by visiting the URL `/jsonapi/commerce_product_variation/parts?filter[sku]=`

Issue fork commerce-3635745

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

rhovland created an issue. See original summary.

jsacksick made their first commit to this issue’s fork.

jsacksick opened merge request !781

jsacksick’s picture

jsacksick commented

Thanks for the report, confirmed.

Since 3.3.13, entity queries for product variations only match the variations the current user can view (CommerceProductHooks::queryCommerceProductVariationAccessAlter(), which follows ProductVariationAccessControlHandler). However, hook_jsonapi_commerce_product_variation_filter_access()`still only granted filtering among published variations (`view commerce_product`) and among own variations (`view own unpublished commerce_product`). As soon as a filter is present, JSON:API restricts the query further using those grants, so unpublished variations were dropped even for users with the manage {bundle} commerce_product_variation permission, who can view them.

Since variations the user can't view are already excluded at the query level, the MR grants filtering among all variations (same as for orders), so filtered and unfiltered collections now return the same variations. Tests cover filtering unpublished variations with and without the manage permission, and filtering the variations of the user's own unpublished products.

jsacksick’s picture

jsacksick commented
Status: Active » Needs review

jsacksick opened merge request !782