REST API and ACLs - should the API return contacts made accessible via an ACL?

Question

My REST API call returns data fine as long as the user has 'view all contacts' permission. But if I turn that off and instead grant the user access to a particular group via an ACL, I get nothing. I've confirmed that the user can see the relevant data through the UI.

Should that work? Or are ACLs not taken into account by the REST API?

Using WordPress and Civi 4.5.8.

Update 1: this issue on the forum suggests it might not be WordPress specific.

Update 2: Just to clarify exactly what I'm doing, here's the relevant part of the URL:

/wp-content/plugins/civicrm/civicrm/extern/rest.php?entity=Contact&action=get&api_key=xxx&key=xxx

I can get the data I want by using the API key of an admin, or if a non-admin has 'View all contacts' permission. But I get no results if the non-admin lacks this permission and only has access via an ACL. (If I change the API key I get an authentication error, so I'm confident that's correct.)

Answer 1

When the Contact Get REST api is triggered, I can see that the permission clause for the ACL is being generated from the whereClause() funcion of CRM_ACL_API. Here a contactId(previously passed as NULL) is fetched from the session (logged in user id) and the contact from api_key is actually not taken into account. Hence a 0 is set for ContactId and ACL permissions are not respected.

Answer 2

I tested this locally & it worked fine - but looking at the wordpress code the signature of the loadBootStrap function does not match the signature of drupal (which works).

I expect it's not responding correctly to

  CRM_Utils_System::loadBootStrap(array('uid' => $uid), TRUE, FALSE);

Since

return $config->userSystem->loadBootStrap($params, $loadUser, $throwError, $realPath);

passes in an array but WP seems to be unable to cope with that