Drupal Apigee API Product RBAC not filtering API Products based on Roles

[urbanenomad]

Description

A clear and concise description of what the bug is.

Apigee Info

We have both apigee hybrid and apigee-x instances that we want to support

Steps to Reproduce

Steps to reproduce the behavior:

1. Enable apigee API product RBAC
   

2. Configured Custom Attribute on some test apigee products
   

Actual Behavior

• Non-admin account that was set to one of the attirbute roles still shows all products even more than if we did just products by visiblity. It now shows all the products.
  

• We also did not enable "Bypass API product access control" nor did we enable "Show API products with missing or empty attribute to everyone"

Expected Behavior

We would have hoped to see when a developer trys to create an App they only see the API products that have their role in the custom attribute

Notes

Add any other context about the problem here.

Version Info

Drupal 10.3.6

Modules:
Apigee: 3.0.10
Apigee API Catalog 3.0.8

[kedarkhaire]

Hi @urbanenomad
Thanks for creating a ticket here. We will look into it.
Thanks!

[urbanenomad]

Is there any updates on this?

[urbanenomad]

Hey so I think I figured out the issue at the following lines.

apigee-edge-drupal/modules/apigee_edge_apiproduct_rbac/apigee_edge_apiproduct_rbac.module

Line 70 in 1e480cf

$result = AccessResult::neutral("{$operation} is not allowed on {$entity->label()} API product.");

the line should read like the following.

$result = AccessResult::forbidden("{$operation} is not allowed on {$entity->label()} API product.");

Same for this line.

apigee-edge-drupal/modules/apigee_edge_apiproduct_rbac/apigee_edge_apiproduct_rbac.module

Line 97 in 1e480cf

$result = AccessResult::neutral("{$operation} is not allowed on {$entity->label()} API product.");

$result = AccessResult::forbidden("{$operation} is not allowed on {$entity->label()} API product.");

This resulted with the correct output on the App Create page.

[kedarkhaire]

Hi @urbanenomad
Thanks for the investigation, Can you please create the PR for the same, we will run the tests and check.
If all good, then we will push the changes in next release.