Under API Roles, I have set all the permissions related to category and product data, and the ability to list such data via SOAP API.
When I set the role to All, the API call works, but that also gives the API user full access rights. This needs to be read only.
Which permission to I need to set in order for this API call to work? I have enabled all of the ones that aren't update, delete, etc.
The method is declared in the api.xml of the catalog module like this:
<listOfAdditionalAttributes translate="title" module="catalog">
<title>Get list of non-default attributes by product type and attributes set</title>
<method>getAdditionalAttributes</method>
<acl>catalog/product/listOfAdditionalAttributes</acl>
</listOfAdditionalAttributes>
Notice the acl tag. That's the one you need.
If you take a look in the same api.xml file in the path api/acl/resources/catalog/product/listOfAdditionalAttributes you will find the title of the checkbox you need to check in the UI: Get list of non-default attributes by product type and attributes set.
But this is funny (funny "huh?" not funny "haha"). There is no trace in the UI for the text I mentioned above.
you may have stumbled onto a bug here.
That's all I found for now. I will add more if/when I find why that specific resource is not present in the roles UI.
[EDIT]
OK, I got it.
Here is how the ACL definition for the listOfAdditionalAttributes looks like:
<listOfAdditionalAttributes>
<title>Get list of non-default attributes by product type and attributes set</title>
</listOfAdditionalAttributes>
Let's take an other ACL definition and compare them:
<create translate="title" module="catalog">
<title>Create</title>
</create>
Notice that the create tag has an attribute called module that listOfAdditionalAttributes does not have.
Inside the method Mage_Adminhtml_Block_Api_Tab_Rolesedit::_getNodeJson, the one that is used to retrieve data for rendering the resource tree there is this:
foreach ($children as $child) {
if ($child->getName()!='title' && $child->getName()!='sort_order' && $child->attributes()->module) {
if ($level != 0) {
$item['children'][] = $this->_getNodeJson($child, $level+1);
} else {
$item = $this->_getNodeJson($child, $level+1);
}
}
}
Notice the last condition in the first if statement. $child->attributes()->module. This means that all the nodes that don't have a module attribute will be skipped.
There is always the simple solution to just add module="catalog" on the listOfAdditionalAttributes node. But don't do that. You will probably be in the same situation after an upgrade, if this does not get fixed by the core team.
Instead you can create your own module with an api.xml file that adds the module attribute.
Let's call this module Easylife_Apifix. You will need these files:
app/etc/modules/Easylife_Apifix.xml - the declaration file
<?xml version="1.0"?>
<config>
<modules>
<Easylife_Apifix>
<codePool>local</codePool>
<active>true</active>
<depends>
<Mage_Api />
</depends>
</Easylife_Apifix>
<Mage_Catalog> <!-- I found out empirically that the Mage_Catalog module must depend on this new module. The other way around it does not work. -->
<depends>
<Easylife_Apifix />
</depends>
</Mage_Catalog>
</modules>
</config>
app/code/local/Easylife/Apifix/etc/config.xml - the configuration file
<?xml version="1.0"?>
<config>
<modules>
<Easylife_Apifix>
<version>1.0.0</version>
</Easylife_Apifix>
</modules>
</config>
app/code/local/Easylife/Apifix/etc/api.xml - the api declaraion file that fixes the issue
<?xml version="1.0"?>
<config>
<api>
<acl>
<resources>
<catalog module="catalog">
<product module="catalog">
<listOfAdditionalAttributes module="catalog" />
</product>
</catalog>
</resources>
</acl>
</api>
</config>
Clear the cache when you are done.
