Can't filter user by status

Created on 27 January 2021, almost 4 years ago
Updated 20 January 2025, 3 days ago

Problem/Motivation

I want for certain role to be able list all active users. I added permission for given role "View user information". Now it if call

/jsonapi/user/user

I get list of all users which is expected behaviour. But if I call

/jsonapi/user/user?filter[status][value]=1

I get error:

{
    "errors": [
        {
            "detail": "The current user is not authorized to filter by the `status` field, given in the path `status`.",
            "links": {
                "info": {
                    "href": "http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.4"
                },
                "via": {
                    "href": "https://XXX/jsonapi/user/user?filter%5Bstatus%5D%5Bvalue%5D=1"
                }
            },
            "status": "403",
            "title": "Forbidden"
        }
    ],
    "jsonapi": {
        "meta": {
            "links": {
                "self": {
                    "href": "http://jsonapi.org/format/1.0/"
                }
            }
        },
        "version": "1.0"
    }
}

For admin user it works so syntax should be ok. I did little research and i was able to get it work for given role only if I assigned permission "Administer users". It doest make sense to me. I can view all users (active and blocked) but I can't filter only active or blocked? And assinging permission "Administer users" seems to be too much.

Steps to reproduce

  1. enable json api module
  2. add permission "View user information" to role that you want to test it
  3. in browser go to /jsonapi/user/user?filter[status][value]=1

Proposed resolution

Allow user status for user with permission "View user information" or if its on purpose for some reason we could add new permission just for user status?

🐛 Bug report
Status

Needs work

Version

11.0 🔥

Component

jsonapi.module

Created by

🇨🇿Czech Republic marysmech

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024