Don't let users see products that are not in assortment

Imar Spaanjaars

Posted on 09/11/2022 13:16:55

Hi there,

I have a site that uses assortments for users. I have also set up an anonymous assortment that contains all products. When an anonymous user is on a product details page, the same product is shown again after the user logs in, even when that product is not in the user's assortment.

How can I test if the user is allowed to see the product or not based on the assortment and redirect them away when they can't see it? I could do it with custom code looking at the assortments or assortment table in the database but wonder if there's a built-in way?

The use case here is that the anonymous page is shown to all users but only has limited info, doesn't display a price and doesn't allow adding to the cart. When logged in, the user does see the price and cart button, but shouldn't see them for products not in the assortment.

Thanks!

Imar

Replies

Nicolai Pedersen

Posted on 10/11/2022 16:05:23

This post has been marked as an answer

You get the product from ProductService.GetProductById(string productId, string productVariantId, string productLanguageId, bool useAssortments) - if it returns null, the product is not in assortment (given you call it with useAssortments=true)

But not sure that will cover your use case.

Then there is HasAccessToProduct(Product product, User user) on the assortment service - but it is internal.

You want it public?

BR Nicolai

Votes for this answer: 1

Imar Spaanjaars

Posted on 10/11/2022 16:13:17

It would be nice if it was public as it seems a more natural solution. Also, I think your first option would determine if a product was in any assortment, not in the assortments the user has access to, right?

Imar

Imar Spaanjaars

Posted on 16/12/2022 16:16:30

I am doubting if my first assessment with the page being shown again was correct. I am now seeing 404s when accessing a product that is not in your assortment.

Ecom frontend,cs around line 400 tells me this:

// No product found always return 404.
// Required behavior in order to support assortments.
if (product is null)
{
_renderer.EndRequestAs404();
}

So it looks like the rendering returns a 404. How can I prevent that from happening? I tried to run some code in the page template or master template but it seems that the module is still executed and returns a 404 before I can run my code. Any solution around this?

Imar

Nicolai Pedersen

Posted on 16/12/2022 17:37:25

Yeah - you need a pageloaded notification subscriber or similar early in pipeline event.

Imar Spaanjaars

Posted on 16/12/2022 17:42:02

Yeah, that's how I fixed it for now; responding to a 404:

[Subscribe(Dynamicweb.Notifications.Standard.Page.NotFound)]
public class RedirectToCustomPageWhenNotInAssortment : NotificationSubscriber
{
  public override void OnNotify(string notification, NotificationArgs args)
  {
    try
    {
      var productIdFromUrl = Context.Current.Request.QueryString.Get("ProductID") ?? string.Empty;
      var isProductDetail = !string.IsNullOrEmpty(productIdFromUrl) && PageView.Current().Page.NavigationTag.ToLower() == "shop";
      // Uses custom extension method on User
      if (!isProductDetail || PageView.Current().User.HasAccessToProductIdInAssortment(productIdFromUrl))
      {
        return;
      }
      var noAccessToAssortmentPageId = Services.Pages.GetPageByNavigationTag(PageView.Current().AreaID, "NoAccessToAssortment")?.ID;
      if (noAccessToAssortmentPageId > 0)
      {
        HttpContext.Current.Response.Redirect($"/Default.aspx?ID={noAccessToAssortmentPageId}");
      }
      else
      {
        HttpContext.Current.Response.Redirect("/");
      }
    }
    catch (Exception)
    {
      HttpContext.Current.Response.Redirect("/");
    }
  }
}

But I can see how PageLoaded may be better as it also handles cases where there is no 404...

Thanks!

Imar

You must be logged in to post in the forum

Developer forum

Don't let users see products that are not in assortment

Replies