I am building a custom subscription module. I have exposed a number of APIs for the frontend to consume.
I have the API hooked into standard repository endpoints:
public function getList(\Magento\Framework\Api\SearchCriteriaInterface $searchCriteria); public function get(int $subId);
These all work fine, however, I want to 'expand' on these endpoints
I want to limit the results of
getList() so it only returns the results belonging to the logged-in customer. At the moment I have just added an extra method to the repository
getCustomerList() which adds an extra constraint on the search in a repository method.
Whilst this works, the repository doesn't feel like the right place for this additional 'authentication' logic.
Is there a better way to deal with this kind of thing? I read that the web API should always point to either a repository interface or a management interface. So how would an extra layer of logic on top of the repository fit in?