Requesting products via REST API using store code in URL returns products from all stores

[careys7]

Preconditions

1. Magento 2.1.3, using Sample Data
2. Environment using magento2-docker-compose

Steps to reproduce

1. Create new integration
2. Create a new website with code "test"
3. Create a new store, assign to the "test" website
4. Create a new store view with code "test", assign to the new store
5. (Optional) - Don't assign any products to the website to make test easier to verify
6. Perform REST API GET request using the store code in the URL, eg:

GET /rest/test/V1/products/?searchCriteria[pageSize]=1&searchCriteria[currentPage]=50 
HTTP/1.1
Host: m2.localhost:8000
Authorization: OAuth oauth_consumer_key="sitoq7tu4b1aj7kikj4irkog8tggh1ch",oauth_token="kr3bly2kbbnrr9flyws9r4mxdaagxngo",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1484095699",oauth_nonce="TivkWr",oauth_version="1.0",oauth_signature="Q02C2wk4AgkDPkYAbACUoLMoXa4%3D"
Cache-Control: no-cache

Expected result

1. Only products assigned to the test website are returned (or no products if none assigned)

Actual result

1. All products in the Magento instance are returned

---

Comments

Is it intended that using a non-"default" store code exposes a global product repository? Reading the documentation it sounds like the request should be limited to the store that's specified:

The value of store_code can be one of the following:

• default
• The assigned store code
• all. This value only applies to the CMS and Product modules. If this value is specified, the API call affects all the merchant's stores. GEToperations cannot be performed when you specify all.

I have also attempted a search criteria filter against the following fields: store, store_id, store_code, website, website_id, website_code, all of which return "Invalid attribute name: %1".

I'm unable to find any other alternatives in the documentation. Is there currently no multistore support in the product API, or have I missed something obvious?

[misha-kotov]

Thanks for reporting this. Internal issue is MAGETWO-63667. Related: GH #4806

[pareshe]

There is patch available for this ?

[misha-kotov]

Here you go.
ab6cc89
you can add .patch to the end of the url to create a patch.

You can find the relevant commits yourself by cloning the repo and grepping the git logs for the internal ticket number, something along the lines of
clone develop from [email protected]:magento/magento2.git
git log | grep -C3 MAGETWO-63667
The output will give you the needed commits.

[barryvdh]

Was this not merged to 2.2? We're having the same issue still. (see #15461)

[Vossie1975]

problem was reported fixed but problem stil exsist. Hope it wil be fixed soon becouse is a major problem with multiple stores with there own products.

[Cyclonecode]

I have the same problem running magento 2.2.6. Thought this was fixed?