Mastering ESHOPMAN Store API Field Restrictions: Understanding the `rbac_filter_fields` Flag

Encountering Unexpected Data in Your ESHOPMAN Store API?

Our ESHOPMAN community recently brought to light an important behavior regarding field restrictions within the ESHOPMAN Store API. Developers aiming to control the data exposed through their HubSpot-deployed storefronts might find that their configured field restrictions aren't taking effect as expected.

The Challenge: Unrestricted Fields in the Store API

A developer reported an issue where, despite explicitly configuring restrictedFields for the Store API, full product objects, including variants, were still being returned. This is contrary to the expected behavior of headless commerce platforms like ESHOPMAN, where granular control over API responses is crucial for security and performance.

The configuration attempted was straightforward:

restrictedFields: {
          store: [
            "products",
            "variants",
          ],
        },

Even with this in place, a query like the following would still yield complete product data:

curl -s "http://localhost:9000/store/products?handle=abc&fields=id,handle,variants.id,variants.title"

The ESHOPMAN Community's Insight: The `rbac_filter_fields` Feature Flag

Through a detailed investigation, our ESHOPMAN team confirmed this behavior and identified the root cause. While the restrictedFields configuration is correctly registered and the system computes the list of fields to be stripped, the final step of actually removing these fields from the query is conditionally gated.

Specifically, the logic responsible for deleting non-allowed fields from the query only executes when the rbac_filter_fields feature flag is enabled. This flag, by default, is set to false in ESHOPMAN installations.

The relevant code snippet, which illustrates this conditional execution, looks like this:

if (notAllowedFields.length && rbacFilterFieldsFeatureFlag) {
  notAllowedFields.forEach((field) => {
    allFields.delete(field)
    starFields.delete(field)
  })
}

This means that even if you've meticulously defined your restricted fields, they won't be actively filtered out unless the rbac_filter_fields flag is explicitly turned on. The documented behavior for restrictedFields does not currently specify this dependency, leading to confusion.

Immediate Workaround for ESHOPMAN Developers

Until a permanent fix is implemented to decouple restrictedFields from the rbac_filter_fields flag, ESHOPMAN developers can enable this feature flag to ensure their field restrictions take effect. By activating rbac_filter_fields, you will immediately see your configured Store API field restrictions functioning as intended, providing the granular control necessary for your headless commerce setup on HubSpot CMS.

Our team is actively tracking this for a future update to streamline the behavior and remove this unexpected dependency, enhancing the developer experience for ESHOPMAN users.

Stay tuned to the ESHOPMAN community for further updates and best practices for managing your storefronts.