Answers.Body: <p>The Access AJAX API permission was added in <a href="https://issues.civicrm.org/jira/browse/CRM-8840" rel="nofollow">CRM-8840</a> to get around the firewall of sorts that surrounds the API unless you have Access CiviCRM.  If you don't have either, you'll get blocked trying any Javascript call to the API, regardless of your other permissions (whether granted via hook, ACLs, or CMS).  </p>
  
  <p>As best I know (and I just did a quick test on a dummy site), all of the APIs require Access CiviCRM or Administer CiviCRM even beside the blanket requirement for Access CiviCRM or Access AJAX API.  While adding Access AJAX API will get your foot in the proverbial door, you won't have the ability to do anything.  You'll want to write a hook to change the permissions in the specific cases that you need to run an API call.</p>
  
  <p>So yes, you're on the right track, and no, there shouldn't be any immediate negative consequences of adding Access AJAX API.  However, since it removes the outer layer of security against the API, you'll just need to be sure everything's configured tightly.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-21T21:28:32.067Z
Answers.Text: Modifying the permissions via the hook doesn't work, unfortunately (see my edit to the original description).
Answers.UserDisplayName: lcdservices
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-21T22:01:10.660Z
Answers.Text: Yeah, that could be a number of things.  When using that hook, I generally have to experiment a bit with it.  You might break down your problem by using straight API calls through the Firebug console like `CRM.api3('Contact', 'get');` and see what returns.  Once you have that working to your liking, you can see if the problem is in your API permissions or something specific to the entityRef.
Answers.UserDisplayName: Andie Hunt
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-18T19:51:30.417Z
Answers.LastActivityDate: 2015-12-18T19:51:30.417Z
Answers.UserDisplayName: Andie Hunt
Answers.Body: <p>I wonder if a better pattern to start with would be custom fields of type "ContactReference" - these go through a different ajax callback which by default does <em>not</em> check permissions (for better or worse).</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-21T21:30:31.483Z
Answers.Text: Just seems like a shame to have to build a workaround like that. In this case, I simply want the current employer field to be a searchable/lookup list for anonymous users. Because the form process already looks for the employer_id field, you simply need to add the field to the form -- no postProcess work required. But if I have to create a custom field, I then need to process that against the native field. It just seems like we should be able to modify the permissions more easily than this.
Answers.UserDisplayName: lcdservices
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-21T15:51:05.717Z
Answers.LastActivityDate: 2015-12-21T15:51:05.717Z
Answers.UserDisplayName: Coleman
Body: <p>I need to add an entityRef lookup field to a public facing profile form so that users can search and select organization contacts. I patterned it after the current employer lookup in the contact record with slight changes (you can't create a new contact):</p>
  
  <pre><code>$props = array(
    'api' =&gt; array('params' =&gt; array(
      'contact_type' =&gt; 'Organization',
      'check_permissions' =&gt; 0,
    )),
  );
  $form-&gt;addEntityRef('employer_id', ts('Organization'), $props);
  </code></pre>
  
  <p>If I access the form anonymously, the lookup fails with a permission error. If I grant the public user "access AJAX API" it does not fail, but does not return any records (because the public user isn't permissioned to view all contacts). You'll see that I attempted to modify the API with check_permissions, but it has no impact.</p>
  
  <p>With "access AJAX API" enabled for the public user, the alterAPIPermissions hook is hit -- so I could modify the perms and avoid granting the public user "view all contacts" permission.</p>
  
  <p>My question is:
  What are the consequences of giving the public user access AJAX API permission? Is there some way to avoid having to do that? Is the above the right way to implement this -- to grant that permission and them modify the actual permissions with the hook?</p>
  
  <p><strong>EDIT:</strong>
  Actually, I don't seem to be able to grant sufficient permissions with alterAPIPermissions. I've tried:</p>
  
  <pre><code>$params['check_permissions'] = 0;
  $permissions['contact']['get'] = array('profile create');
  $permissions['contact']['getquick'] = array('profile create');
  </code></pre>
  
  <p>(the anonymous user has profile create permission) and the entityRef still returns no records.</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-12-22T16:55:54.067Z
Comments.Text: FYI The reason changing `$params['check_permissions']` to false doesn't work is because these params are then sent to the server from the javascript widget, and for good reasons, the server will not trust rest requests attempting to disable permission checks.
Comments.UserDisplayName: Coleman
Tags: <api><permissions><hooks>
Title: allow public access to entityRef field contact lookup
ThreadText: # allow public access to entityRef field contact lookup
  
  (Asked by: username_0 on 2015-12-18)
  
  I need to add an entityRef lookup field to a public facing profile form so that users can search and select organization contacts. I patterned it after the current employer lookup in the contact record with slight changes (you can't create a new contact):
  $props = array(
    'api' => array('params' => array(
      'contact_type' => 'Organization',
      'check_permissions' => 0,
    )),
  );
  $form->addEntityRef('employer_id', ts('Organization'), $props);
  
  If I access the form anonymously, the lookup fails with a permission error. If I grant the public user "access AJAX API" it does not fail, but does not return any records (because the public user isn't permissioned to view all contacts). You'll see that I attempted to modify the API with check_permissions, but it has no impact.
  With "access AJAX API" enabled for the public user, the alterAPIPermissions hook is hit -- so I could modify the perms and avoid granting the public user "view all contacts" permission.
  My question is:
  What are the consequences of giving the public user access AJAX API permission? Is there some way to avoid having to do that? Is the above the right way to implement this -- to grant that permission and them modify the actual permissions with the hook?
  EDIT:
  Actually, I don't seem to be able to grant sufficient permissions with alterAPIPermissions. I've tried:
  $params['check_permissions'] = 0;
  $permissions['contact']['get'] = array('profile create');
  $permissions['contact']['getquick'] = array('profile create');
  
  (the anonymous user has profile create permission) and the entityRef still returns no records.
  
  **Tags:** api, permissions, hooks
  
  > **Comments:**
  > **username_1**: FYI The reason changing `$params['check_permissions']` to false doesn't work is because these params are then sent to the server from the javascript widget, and for good reasons, the server will not trust rest requests attempting to disable permission checks.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2015-12-18. Score: 2
  
  The Access AJAX API permission was added in [CRM-8840](https://issues.civicrm.org/jira/browse/CRM-8840) to get around the firewall of sorts that surrounds the API unless you have Access CiviCRM. If you don't have either, you'll get blocked trying any Javascript call to the API, regardless of your other permissions (whether granted via hook, ACLs, or CMS).
  
  As best I know (and I just did a quick test on a dummy site), all of the APIs require Access CiviCRM or Administer CiviCRM even beside the blanket requirement for Access CiviCRM or Access AJAX API. While adding Access AJAX API will get your foot in the proverbial door, you won't have the ability to do anything. You'll want to write a hook to change the permissions in the specific cases that you need to run an API call.
  
  So yes, you're on the right track, and no, there shouldn't be any immediate negative consequences of adding Access AJAX API. However, since it removes the outer layer of security against the API, you'll just need to be sure everything's configured tightly.
  
  > **Comments:**
  > **username_0**: Modifying the permissions via the hook doesn't work, unfortunately (see my edit to the original description).  
  > **username_2**: Yeah, that could be a number of things.  When using that hook, I generally have to experiment a bit with it.  You might break down your problem by using straight API calls through the Firebug console like `CRM.api3('Contact', 'get');` and see what returns.  Once you have that working to your liking, you can see if the problem is in your API permissions or something specific to the entityRef.  
  
  ---
  
  ### Answer by username_1 on 2015-12-21. Score: 1
  
  I wonder if a better pattern to start with would be custom fields of type "ContactReference" - these go through a different ajax callback which by default does *not* check permissions (for better or worse).
  
  > **Comments:**
  > **username_0**: Just seems like a shame to have to build a workaround like that. In this case, I simply want the current employer field to be a searchable/lookup list for anonymous users. Because the form process already looks for the employer_id field, you simply need to add the field to the form -- no postProcess work required. But if I have to create a custom field, I then need to process that against the native field. It just seems like we should be able to modify the permissions more easily than this.  
  
  ---
  
  