I need to add an entityRef lookup field to a public facing profile form so that users can search and select organization contacts. I patterned it after the current employer lookup in the contact record with slight changes (you can't create a new contact):
$props = array( 'api' => array('params' => array( 'contact_type' => 'Organization', 'check_permissions' => 0, )), ); $form->addEntityRef('employer_id', ts('Organization'), $props);
If I access the form anonymously, the lookup fails with a permission error. If I grant the public user "access AJAX API" it does not fail, but does not return any records (because the public user isn't permissioned to view all contacts). You'll see that I attempted to modify the API with check_permissions, but it has no impact.
With "access AJAX API" enabled for the public user, the alterAPIPermissions hook is hit -- so I could modify the perms and avoid granting the public user "view all contacts" permission.
My question is: What are the consequences of giving the public user access AJAX API permission? Is there some way to avoid having to do that? Is the above the right way to implement this -- to grant that permission and them modify the actual permissions with the hook?
EDIT: Actually, I don't seem to be able to grant sufficient permissions with alterAPIPermissions. I've tried:
$params['check_permissions'] = 0; $permissions['contact']['get'] = array('profile create'); $permissions['contact']['getquick'] = array('profile create');
(the anonymous user has profile create permission) and the entityRef still returns no records.