REST API Ignores User Role Scope

[engcom-Delta]

Description:
https://github.com/magento/partners-magento2ee/issues/92

Preconditions (*)

1. Magento 2.2.10 & 2.3.x EE
2. Multi-site installation (min 2 store views)
3. Orders placed against multiple store views

Steps to reproduce (*)

1. Create a new admin user role in a multi-site setup
   2.Assign the user role's scope to 1 store view
   
2. Create a new admin user and attach the previously created role to the new user
3. Create an admin token via a REST call using the newly created user (/V1/integration/admin/token)
4. Call the orders REST API with the above token (/V1/orders)
   

Expected result (*)

1. Only orders in the store view that matches the admin user's role scope will be returned

Actual result (*)

1. All orders for all store views are returned and ignoring the User role scope
2. screenshot for reference

[m2-assistant]

Hi @engcom-Delta. Thank you for your report.
To speed up processing of this issue, make sure that you provided the following information:

• Summary of the issue
• Information on your environment
• Steps to reproduce
• Expected and actual results

Make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce. To deploy vanilla Magento instance on our environment, Add a comment to the issue:

@magento give me 2.4-develop instance - upcoming 2.4.x release

For more details, review the Magento Contributor Assistant documentation.

Add a comment to assign the issue: @magento I am working on this

To learn more about issue processing workflow, refer to the Code Contributions.

---

• Join Magento Community Engineering Slack and ask your questions in #github channel.

⚠️ According to the Magento Contribution requirements, all issues must go through the Community Contributions Triage process. Community Contributions Triage is a public meeting.

🕙 You can find the schedule on the Magento Community Calendar page.

📞 The triage of issues happens in the queue order. If you want to speed up the delivery of your contribution, join the Community Contributions Triage session to discuss the appropriate ticket.

✏️ Feel free to post questions/proposals/feedback related to the Community Contributions Triage process to the corresponding Slack Channel

[github-jira-sync-bot]

✅ Jira issue https://jira.corp.magento.com/browse/AC-3124 is successfully created for this GitHub issue.

[m2-assistant]

✅ Confirmed by @engcom-Hotel. Thank you for verifying the issue.
Issue Available: @engcom-Hotel, You will be automatically unassigned. Contributors/Maintainers can claim this issue to continue. To reclaim and continue work, reassign the ticket to yourself.

[engcom-Delta]

Further investigation and confirmation from @glo82145 we found out that currently in the existing system, this is the default behaviour and filtering of data, store scope wise is not done according to user role scope. Scopes of users which is define in acl.xml file in any module is just used to provide access to api. (which user can access which api) and currently not working on data filter.

Hence, This is working according to default behaviour.

Hence closed