Problem/Motivation

When I try to expose the configurable language resource through JSON:API I've got the following access check:

"The current user is not allowed to GET the selected resource. The 'administer languages' permission is required."

This is due to the fact that all requests to the JSON:API endpoint are considered to be made by unauthenticated users and I don't want to grant anonymous users "administer languages" permission in order to have the languages in JSON API.

Steps to reproduce

  1. Enable the JSON:API module
  2. Enable the Languge module
  3. (optional) Enable the "Configurable Language" resource in JSON:API extras if needed.
  4. (optional) Enable the "Configurable Language" resource in JSON:API extras if needed.
  5. Send an HTTP request to: {domain}/jsonapi/configurable_language/configurable_language

Proposed resolution

The quick fix for that is to implement hook_entity_access or hook_ENTITY_TYPE_access to modify the access control handler for "view" operations.

Another solution is to introduce a "view" permission for configurable languages similar to the Vocabulary entity where the "Access the taxonomy vocabulary overview page" permission can be used to have all vocabularies exposed through JSON:API

I'd like to hear your opinion on that.

Remaining tasks

Nothing yet.

User interface changes

Nope

API changes

Nope

Data model changes

Nope

Release notes snippet

Comments

nikolabintev created an issue. See original summary.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.