currentUser might not be fully populated

Created on 2 August 2023, 11 months ago

Problem/Motivation

When a View returns rows with permission checks, a fully populated User object is required. However, when a user accesses the JSON API via an OAuth Bearer token using the Simple OAuth (OAuth2) & OpenID Connect β†’ module, the provided User object is incomplete. Consequently, the response returned is that of a generic authenticated user, not a response based on the specific user's roles and permissions.

Steps to Reproduce

  1. Create a View accessible only to authenticated users, with the displayed entities being determined by user permissions (roles).
  2. Create two users with different permissions, each of whom should see different view outputs.
  3. Access the /jsonapi/views/[view_name]/[view_page] endpoint with bearer tokens for each user.

The returned JSON will be identical for both users, which is incorrect.

Proposed Resolution

Fully reload the User object after authentication. This should ensure the User object is fully populated and can be used correctly for permission checks.

πŸ› Bug report
Status

Active

Version

1.1

Component

Code

Created by

πŸ‡¬πŸ‡§United Kingdom seogow

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.69.0 2024