Order item types need a custom access control handler

Created on 2 November 2018, about 6 years ago
Updated 23 October 2024, about 2 months ago

Permissions for seeing/getting Type/Bundle information from Order Items is not available.

This presents a problem in situations where we need that information contextually.
For example, In a view If we try to add a Order Item Type field to display or to use, that data is not accessible by users without the .

I see a couple of ways to resolve this,

I think the best way would just be defining "view" permissions in the \commerce_order\OrderItemPermissionProvider.
Something like the following could work.

      $permissions["view {$bundle_name} {$entity_type_id}"] = [
        'title' => $this->t('[Order items] View %bundle', [
          '%bundle' => $bundle_info['label'],
        ]),
      ];

We could also just have \commerce_order\OrderItemPermissionProvider extend \Drupal\entity\EntityPermissionProvider but this would create a bunch of unused permissions.

Any thoughts?

🐛 Bug report
Status

Needs review

Version

2.0

Component

Order

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024