0

Under API Roles, I have set all the permissions related to category and product data, and the ability to list such data via SOAP API.

When I set the role to All, the API call works, but that also gives the API user full access rights. This needs to be read only.

Which permission to I need to set in order for this API call to work? I have enabled all of the ones that aren't update, delete, etc.

Screenshot1

Screenshot2

1

The method is declared in the api.xml of the catalog module like this:

<listOfAdditionalAttributes translate="title" module="catalog">
    <title>Get list of non-default attributes by product type and attributes set</title>
    <method>getAdditionalAttributes</method>
    <acl>catalog/product/listOfAdditionalAttributes</acl>
</listOfAdditionalAttributes>

Notice the acl tag. That's the one you need.
If you take a look in the same api.xml file in the path api/acl/resources/catalog/product/listOfAdditionalAttributes you will find the title of the checkbox you need to check in the UI: Get list of non-default attributes by product type and attributes set.
But this is funny (funny "huh?" not funny "haha"). There is no trace in the UI for the text I mentioned above.
you may have stumbled onto a bug here.

That's all I found for now. I will add more if/when I find why that specific resource is not present in the roles UI.

[EDIT]
OK, I got it.
Here is how the ACL definition for the listOfAdditionalAttributes looks like:

<listOfAdditionalAttributes>
   <title>Get list of non-default attributes by product type and attributes set</title>
</listOfAdditionalAttributes>

Let's take an other ACL definition and compare them:

<create translate="title" module="catalog">
    <title>Create</title>
</create>

Notice that the create tag has an attribute called module that listOfAdditionalAttributes does not have.
Inside the method Mage_Adminhtml_Block_Api_Tab_Rolesedit::_getNodeJson, the one that is used to retrieve data for rendering the resource tree there is this:

foreach ($children as $child) {
    if ($child->getName()!='title' && $child->getName()!='sort_order' && $child->attributes()->module) {
        if ($level != 0) {
            $item['children'][] = $this->_getNodeJson($child, $level+1);
        } else {
            $item = $this->_getNodeJson($child, $level+1);
        }
    }
}

Notice the last condition in the first if statement. $child->attributes()->module. This means that all the nodes that don't have a module attribute will be skipped.

Solution

There is always the simple solution to just add module="catalog" on the listOfAdditionalAttributes node. But don't do that. You will probably be in the same situation after an upgrade, if this does not get fixed by the core team.
Instead you can create your own module with an api.xml file that adds the module attribute.
Let's call this module Easylife_Apifix. You will need these files:

app/etc/modules/Easylife_Apifix.xml - the declaration file

<?xml version="1.0"?>
<config>
    <modules>
        <Easylife_Apifix>
            <codePool>local</codePool>
            <active>true</active>
            <depends>
                <Mage_Api />
            </depends>
        </Easylife_Apifix>
        <Mage_Catalog> <!-- I found out empirically that the Mage_Catalog module must depend on this new module. The other way around it does not work. -->
            <depends>
                <Easylife_Apifix />
            </depends>
        </Mage_Catalog>
    </modules>
</config>

app/code/local/Easylife/Apifix/etc/config.xml - the configuration file

<?xml version="1.0"?>
<config>
    <modules>
        <Easylife_Apifix>
            <version>1.0.0</version>
        </Easylife_Apifix>
    </modules>
</config>

app/code/local/Easylife/Apifix/etc/api.xml - the api declaraion file that fixes the issue

<?xml version="1.0"?>
<config>
    <api>
        <acl>
            <resources>
                <catalog module="catalog">
                    <product module="catalog">
                        <listOfAdditionalAttributes module="catalog" />
                    </product>
                </catalog>
            </resources>
        </acl>
    </api>
</config>

Clear the cache when you are done.

  • I knew something seemed off. Good to know I'm not going crazy after all! – DWils Oct 23 '14 at 16:05
  • I've confirmed this fix as working, and also reported it to Magento support, (referencing this thread). Hopefully they can resolve it in a future release. Thanks again – DWils Oct 25 '14 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.