fix(mgr-api): correct ACL list total and bulk 403 responses

Over-fetch visible rows for paginated grids, count ACL-visible total,
batch-load products for view filter, and return 403 when bulk actions
are denied solely by document policy.

Author: Ibochkarev

core/components/minishop3/src/Controllers/Api/Manager/CategoryProductsController.php

@@ -63,7 +63,8 @@ public function getList(array $params = []): array
             return Response::error('Category products list service is not available', 500)->getData();
         }
 
-        $page = $listService->getPage(
+        $results = $this->collectVisibleListPage(
+            $listService,
             $categoryId,
             $params,
             $nested,
@@ -74,11 +75,19 @@ public function getList(array $params = []): array
             $sortDir
         );
 
-        $results = $this->filterListResultsByDocumentView($page['results'], $nested);
+        $total = $this->countVisibleListResults(
+            $listService,
+            $categoryId,
+            $params,
+            $nested,
+            $gridFields,
+            (string) $sortBy,
+            $sortDir
+        );
 
         return Response::success([
             'results' => $results,
-            'total' => $page['total'],
+            'total' => $total,
         ])->getData();
     }
 
@@ -235,6 +244,7 @@ public function multiple(array $params = []): array
 
         $success = 0;
         $failed = 0;
+        $policyDenied = 0;
         $scope = $this->scopeService();
 
         foreach ($ids as $id) {
@@ -250,7 +260,7 @@ public function multiple(array $params = []): array
                 && !CategoryProductDocumentPolicy::isAllowedAll($product, $documentPolicies)
             ) {
                 $this->logDocumentPolicyDenied($product, $documentPolicies);
-                $failed++;
+                $policyDenied++;
                 continue;
             }
 
@@ -274,6 +284,13 @@ public function multiple(array $params = []): array
         }
 
         if ($success === 0) {
+            if ($policyDenied > 0) {
+                return Response::error(
+                    'Save permission denied for this document',
+                    HttpStatus::FORBIDDEN
+                )->getData();
+            }
+
             return Response::error('No products were updated', HttpStatus::INTERNAL_SERVER_ERROR)->getData();
         }
 
@@ -407,27 +424,166 @@ private function requireCategoryWithView(int $categoryId): object|array
      */
     private function filterListResultsByDocumentView(array $results, bool $nested): array
     {
-        $filtered = [];
+        if ($results === []) {
+            return [];
+        }
 
-        foreach ($results as $row) {
-            $productId = (int) ($row['id'] ?? 0);
-            if ($productId <= 0) {
-                continue;
+        $productIds = array_values(array_filter(array_map(
+            static fn (array $row): int => (int) ($row['id'] ?? 0),
+            $results
+        )));
+
+        if ($productIds === []) {
+            return [];
+        }
+
+        /** @var array<int, msProduct> $productsById */
+        $productsById = [];
+        $collection = $this->modx->getCollection(msProduct::class, ['id:IN' => $productIds]);
+        foreach ($collection as $product) {
+            if ($product instanceof msProduct) {
+                $productsById[(int) $product->get('id')] = $product;
+            }
+        }
+
+        /** @var array<int, msCategory> $parentsById */
+        $parentsById = [];
+        if ($nested) {
+            $parentIds = array_values(array_unique(array_filter(array_map(
+                static fn (array $row): int => (int) ($row['parent'] ?? 0),
+                $results
+            ))));
+            if ($parentIds !== []) {
+                $parentCollection = $this->modx->getCollection(msCategory::class, ['id:IN' => $parentIds]);
+                foreach ($parentCollection as $parent) {
+                    if ($parent instanceof msCategory) {
+                        $parentsById[(int) $parent->get('id')] = $parent;
+                    }
+                }
             }
+        }
 
-            $product = $this->modx->getObject(msProduct::class, $productId);
+        $filtered = [];
+        foreach ($results as $row) {
+            $productId = (int) ($row['id'] ?? 0);
+            $product = $productsById[$productId] ?? null;
             if (!$product instanceof msProduct) {
                 continue;
             }
 
-            if (CategoryProductDocumentPolicy::canViewInCategoryGrid($this->modx, $product, $nested)) {
+            if (CategoryProductDocumentPolicy::canViewInCategoryGridCached($product, $nested, $parentsById)) {
                 $filtered[] = $row;
             }
         }
 
         return $filtered;
     }
 
+    /**
+     * @param array<int, array<string, mixed>> $gridFields
+     * @return list<array<string, mixed>>
+     */
+    private function collectVisibleListPage(
+        CategoryProductsListService $listService,
+        int $categoryId,
+        array $params,
+        bool $nested,
+        array $gridFields,
+        int $start,
+        int $limit,
+        string $sortBy,
+        string $sortDir,
+    ): array {
+        if ($limit <= 0) {
+            return [];
+        }
+
+        $visible = [];
+        $scanOffset = 0;
+        $skipped = 0;
+        $batchSize = max($limit * 2, 20);
+
+        while (count($visible) < $limit) {
+            $page = $listService->getPage(
+                $categoryId,
+                $params,
+                $nested,
+                $gridFields,
+                $scanOffset,
+                $batchSize,
+                $sortBy,
+                $sortDir
+            );
+
+            if ($page['results'] === []) {
+                break;
+            }
+
+            $filtered = $this->filterListResultsByDocumentView($page['results'], $nested);
+            foreach ($filtered as $row) {
+                if ($skipped < $start) {
+                    $skipped++;
+                    continue;
+                }
+
+                $visible[] = $row;
+                if (count($visible) >= $limit) {
+                    break 2;
+                }
+            }
+
+            $scanOffset += count($page['results']);
+            if (count($page['results']) < $batchSize) {
+                break;
+            }
+        }
+
+        return $visible;
+    }
+
+    /**
+     * @param array<int, array<string, mixed>> $gridFields
+     */
+    private function countVisibleListResults(
+        CategoryProductsListService $listService,
+        int $categoryId,
+        array $params,
+        bool $nested,
+        array $gridFields,
+        string $sortBy,
+        string $sortDir,
+    ): int {
+        $visible = 0;
+        $scanOffset = 0;
+        $batchSize = 200;
+
+        while (true) {
+            $page = $listService->getPage(
+                $categoryId,
+                $params,
+                $nested,
+                $gridFields,
+                $scanOffset,
+                $batchSize,
+                $sortBy,
+                $sortDir
+            );
+
+            if ($page['results'] === []) {
+                break;
+            }
+
+            $visible += count($this->filterListResultsByDocumentView($page['results'], $nested));
+            $scanOffset += count($page['results']);
+
+            if (count($page['results']) < $batchSize) {
+                break;
+            }
+        }
+
+        return $visible;
+    }
+
     /** @param list<string> $policies */
     private function logDocumentPolicyDenied(msProduct $product, array $policies): void
     {

core/components/minishop3/src/Services/Category/CategoryProductDocumentPolicy.php

@@ -117,6 +117,35 @@ public static function canViewInCategoryGrid(modX $modx, msProduct $product, boo
         return self::isAllowed($parent, self::POLICY_VIEW);
     }
 
+    /**
+     * @param array<int, msCategory> $parentsById
+     */
+    public static function canViewInCategoryGridCached(
+        msProduct $product,
+        bool $nested,
+        array $parentsById,
+    ): bool {
+        if (!self::isAllowed($product, self::POLICY_VIEW)) {
+            return false;
+        }
+
+        if (!$nested) {
+            return true;
+        }
+
+        $parentId = (int) $product->get('parent');
+        if ($parentId <= 0) {
+            return false;
+        }
+
+        $parent = $parentsById[$parentId] ?? null;
+        if (!$parent instanceof msCategory) {
+            return false;
+        }
+
+        return self::isAllowed($parent, self::POLICY_VIEW);
+    }
+
     public static function toErrorResponse(?array $evaluation): ?array
     {
         if ($evaluation === null) {