Magento 2 REST API层面按店铺限制用户访问的方案咨询

Great question—this is a super common pain point with Magento 2's multi-store setup when working with REST APIs, and it’s absolutely feasible to implement store-specific access controls for your API users. Let’s break down the problem and solutions:

Why the Default Setup Fails #

Magento 2’s REST API treats the {store code} in the URL as just a context switch, not a permission check. Even if you create separate users for each store, the platform only verifies if the user has general API permissions (like Magento_Catalog::categories), not whether they’re allowed to access that specific store’s data. That’s why users can just swap out the store code in their request to access other stores.

Solution Options #

Option 1: Custom Development (Full Control) #

You can build this restriction yourself using Magento’s native extension points. Here’s a step-by-step approach:

1. Add a User Attribute to Link Users to Stores

   • First, extend the admin/integration user model with an attribute (e.g., allowed_store_codes) to store the list of store codes the user can access. You can do this via a setup script or the Magento admin’s Attribute Management (for admin users).
   • For example, store the allowed codes as a comma-separated string (e.g., us_store,ca_store) or use a multi-select attribute.

2. Create an API Request Interceptor

   • Use Magento’s plugin/interceptor system to hook into API requests and validate the user’s allowed stores against the requested store code.
   • Target the \Magento\Webapi\Controller\Rest::dispatch method to intercept all REST API requests, or narrow it down to specific endpoints (like V1/categories) if you only need restrictions for certain resources.

   Here’s a simplified example of an interceptor for admin users:

   <?php
   namespace YourVendor\StoreApiRestriction\Plugin;
   
   use Magento\Framework\Webapi\Exception;
   use Magento\Webapi\Controller\Rest;
   use Magento\Framework\App\RequestInterface;
   use Magento\Backend\Model\Auth\Session as AdminAuthSession;
   
   class RestControllerStoreCheck
   {
       protected $adminAuthSession;
   
       public function __construct(AdminAuthSession $adminAuthSession)
       {
           $this->adminAuthSession = $adminAuthSession;
       }
   
       public function beforeDispatch(Rest $subject, RequestInterface $request)
       {
           $currentUser = $this->adminAuthSession->getUser();
           if (!$currentUser) {
               // Handle integration users here using \Magento\Integration\Model\Oauth\Token\UserContext
               return;
           }
   
           // Extract store code from the request URL
           $requestedStoreCode = $request->getRoute()->getParam('store');
           if (!$requestedStoreCode) {
               return;
           }
   
           // Get user's allowed stores (adjust based on your attribute setup)
           $allowedStoreCodes = explode(',', $currentUser->getAllowedStoreCodes());
           if (!in_array($requestedStoreCode, $allowedStoreCodes)) {
               throw new Exception(
                   __('You are not authorized to access data for this store.'),
                   Exception::HTTP_FORBIDDEN
               );
           }
       }
   }
   

   • For integration users (using OAuth tokens), replace AdminAuthSession with \Magento\Integration\Model\Oauth\Token\UserContext to fetch the active integration user’s details.

3. Optional: Fine-Grained Permission Checks

   • If you need more control (e.g., allow a user to access categories but not products for a store), combine the store check with Magento’s ACL system. Validate both the user’s store access and their specific resource permissions in the interceptor.

Option 2: Use Existing Marketplace Extensions #

If you don’t want to build custom code, several Magento Marketplace extensions can handle this:

• Store Restriction for REST API: Look for extensions that explicitly mention binding API users to specific stores and blocking cross-store requests.
• Multi-Store Access Control Suites: Some broader multi-store management extensions include API-level store restrictions as part of their feature set. Always check reviews and test the extension in a staging environment first to ensure it fits your needs.

Feasibility Verdict #

This is 100% achievable with Magento 2’s flexible architecture. Whether you go the custom development route (for full customization) or use a pre-built extension (for faster deployment), you can lock down API users to only access the stores they’re assigned to.

内容的提问来源于stack exchange，提问作者Sérgio M.