feat(mgr-api): category-scoped PUT для inline-edit product data - #474
Open
Ibochkarev wants to merge 2 commits into
Open
feat(mgr-api): category-scoped PUT для inline-edit product data#474Ibochkarev wants to merge 2 commits into
Ibochkarev wants to merge 2 commits into
Conversation
Ibochkarev
force-pushed
the
feat/issue-455-category-scoped-product-data
branch
from
July 29, 2026 11:36
3fe9853 to
87a6c43
Compare
Add PUT /categories/{id}/products/{productId}/data with URL-bound scope
check; switch CategoryProductsGrid to the new route (#455).
Apply CategoryProductDocumentPolicy save check on the updateProductData inline-edit path (#473 pattern) and resolve scope via CategoryProductScopePolicy through findInCategory() instead of the separate isProductInCategoryScope() bool-only getObject round-trip. - Import CategoryProductDocumentPolicy (cherry-picked from #473) - Refactor CategoryProductScopeService::findInCategory nested branch to delegate to CategoryProductScopePolicy::isParentInScope - Replace isProductInCategoryScope() call in updateProductData with scopeService()->findInCategory() (single lookup, yields product for ACL) - Add 403 save-policy guard + logDocumentPolicyDenied helper - Tests: CategoryProductDocumentPolicyTest + ACL denial / out-of-scope cases in CategoryProductsControllerScopeTest; stubs support per-product policies and lexicon
Ibochkarev
force-pushed
the
feat/issue-455-category-scoped-product-data
branch
from
July 29, 2026 17:32
508df77 to
fed58c0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Описание
Category-scoped маршрут для inline-edit в гриде «Товары категории»: scope берётся из URL, а не из body
category_id.PUT /api/mgr/categories/{categoryId}/products/{productId}/data+PermissionMiddleware(msproduct_save)CategoryProductsListService::isProductInCategoryScope()(общий helperCategoryProductScopePolicy::allowedParentCategoryIdsс фильтром списка)ms3_err_product_not_in_category_scopeпри товаре вне scope (direct / nested)useCategoryProductsInlineEdit→ новый URL;ProductDataFields.vue— без изменений (PUT /product-data/{id})Closes #455
Тип изменений
Связанные Issues
Closes #455
Follow-up к #444 / #454. Дополняет #418 (scope policy, другой endpoint).
Как это было протестировано?
php -l— все PHP под src/migrations/testsSmoke:
CategoryProductScopePolicyTest.php+ 18 существующих тестов — exit 0Ручное тестирование
Автоматические тесты
Тестирование на разных версиях PHP/MODX
Чеклист
ms3_err_product_not_in_category_scope)PUT /product-data/{id}не изменёнДополнительные заметки
nestedпринимается из query или body; URL-параметры{id}/{productId}не перебиваются body (array_merge($data, $_GET, $params)).category_idна/product-data/{id}можно deprecate отдельно (out of scope).