modx-pro · biz87 · Sep 7, 2026 · Aug 19, 2026 · Sep 7, 2026
diff --git a/_build/build.php b/_build/build.php
@@ -471,40 +471,15 @@ private function chunks(): void
     }
 
     /**
-     * Add access policy
+     * Access policies are nested under policy templates (see policyTemplates()).
      */
     private function policies(): void
     {
-        /** @noinspection PhpIncludeInspection */
-        $policies = include($this->config['elements'] . 'policies.php');
-        if (!is_array($policies)) {
-            $this->modx->log(modX::LOG_LEVEL_ERROR, 'Could not package in Access Policies');
-            return;
-        }
-        $attributes = [
-            xPDOTransport::PRESERVE_KEYS => false,
-            xPDOTransport::UNIQUE_KEY => ['name'],
-            xPDOTransport::UPDATE_OBJECT => !empty($this->config['update']['policies']),
-        ];
-        foreach ($policies as $name => $data) {
-            if (isset($data['data'])) {
-                $data['data'] = json_encode($data['data']);
-            }
-            /** @var $policy modAccessPolicy */
-            $policy = $this->modx->newObject(modAccessPolicy::class);
-            $policy->fromArray(array_merge([
-                    'name' => $name,
-                    'lexicon' => $this->config['name_lower'] . ':permissions',
-                ], $data)
-                , '', true, true);
-            $vehicle = $this->builder->createVehicle($policy, $attributes);
-            $this->builder->putVehicle($vehicle);
-        }
-        $this->modx->log(modX::LOG_LEVEL_INFO, 'Packaged in ' . count($policies) . ' Access Policies');
+        $this->modx->log(modX::LOG_LEVEL_INFO, 'Access policies packaged via policyTemplates()');
     }
 
     /**
-     * Add policy templates
+     * Add policy templates (and nested default policies).
      */
     private function policyTemplates(): void
     {
@@ -514,6 +489,11 @@ private function policyTemplates(): void
             $this->modx->log(modX::LOG_LEVEL_ERROR, 'Could not package in Policy Templates');
             return;
         }
+        /** @noinspection PhpIncludeInspection */
+        $policy_definitions = include($this->config['elements'] . 'policies.php');
+        if (!is_array($policy_definitions)) {
+            $policy_definitions = [];
+        }
         $attributes = [
             xPDOTransport::PRESERVE_KEYS => false,
             xPDOTransport::UNIQUE_KEY => ['name'],
@@ -525,6 +505,11 @@ private function policyTemplates(): void
                     xPDOTransport::UPDATE_OBJECT => !empty($this->config['update']['permission']),
                     xPDOTransport::UNIQUE_KEY => ['template', 'name'],
                 ],
+                'Policies' => [
+                    xPDOTransport::PRESERVE_KEYS => false,
+                    xPDOTransport::UPDATE_OBJECT => !empty($this->config['update']['policies']),
+                    xPDOTransport::UNIQUE_KEY => ['name'],
+                ],
             ],
         ];
         foreach ($policy_templates as $name => $data) {
@@ -542,17 +527,37 @@ private function policyTemplates(): void
                     $permissions[] = $permission;
                 }
             }
-            /** @var $permission modAccessPolicyTemplate */
-            $permission = $this->modx->newObject(modAccessPolicyTemplate::class);
-            $permission->fromArray(array_merge([
+            /** @var modAccessPolicyTemplate $template */
+            $template = $this->modx->newObject(modAccessPolicyTemplate::class);
+            $template->fromArray(array_merge([
                     'name' => $name,
                     'lexicon' => $this->config['name_lower'] . ':permissions',
                 ], $data)
                 , '', true, true);
             if (!empty($permissions)) {
-                $permission->addMany($permissions);
+                $template->addMany($permissions);
+            }
+            if ($name === 'miniShopManagerPolicyTemplate' && $policy_definitions !== []) {
+                $policies = [];
+                foreach ($policy_definitions as $policyName => $policyData) {
+                    $payload = $policyData;
+                    if (isset($payload['data']) && is_array($payload['data'])) {
+                        $payload['data'] = json_encode($payload['data']);
+                    }
+                    /** @var modAccessPolicy $policy */
+                    $policy = $this->modx->newObject(modAccessPolicy::class);
+                    $policy->fromArray(array_merge([
+                            'name' => $policyName,
+                            'lexicon' => $this->config['name_lower'] . ':permissions',
+                        ], $payload)
+                        , '', true, true);
+                    $policies[] = $policy;
+                }
+                if ($policies !== []) {
+                    $template->addMany($policies, 'Policies');
+                }
             }
-            $vehicle = $this->builder->createVehicle($permission, $attributes);
+            $vehicle = $this->builder->createVehicle($template, $attributes);
             $this->builder->putVehicle($vehicle);
         }
         $this->modx->log(modX::LOG_LEVEL_INFO, 'Packaged in ' . count($policy_templates) . ' Access Policy Templates');

diff --git a/_build/elements/policies.php b/_build/elements/policies.php
@@ -1,28 +1,5 @@
 <?php
 
-$permissions = [
-    'mscategory_save',
-    'msproduct_save',
-    'msproduct_publish',
-    'msproduct_delete',
-    'msorder_save',
-    'msorder_view',
-    'msorder_list',
-    'msorder_remove',
-    'mssetting_save',
-    'mssetting_view',
-    'mssetting_list',
-    'msproductfile_save',
-    'msproductfile_generate',
-    'msproductfile_list',
-];
+declare(strict_types=1);
 
-return [
-    'miniShopManagerPolicy' => [
-        'description' => 'A policy for create and update MiniShop3 categories and products.',
-        'parent' => 0,
-        'class' => '',
-        'lexicon' => 'minishop3:permissions',
-        'data' => array_fill_keys($permissions, true),
-    ],
-];
+return require dirname(__DIR__, 2) . '/core/components/minishop3/config/manager_access_policy.php';
diff --git a/_build/resolvers/resolver_09_policies.php b/_build/resolvers/resolver_09_policies.php
@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+use MODX\Revolution\modAccessPolicy;
+use MODX\Revolution\modAccessPolicyTemplate;
+use MODX\Revolution\modX;
+use xPDO\Transport\xPDOTransport;
+
+/** @var xPDOTransport $transport */
+/** @var array<string, mixed> $options */
+if (!$transport->xpdo || !($transport instanceof xPDOTransport)) {
+    return false;
+}
+
+$modx = $transport->xpdo;
+$action = $options[xPDOTransport::PACKAGE_ACTION] ?? null;
+if (!in_array($action, [xPDOTransport::ACTION_INSTALL, xPDOTransport::ACTION_UPGRADE], true)) {
+    return true;
+}
+
+$definitionsFile = MODX_CORE_PATH . 'components/minishop3/config/manager_access_policy.php';
+if (!is_readable($definitionsFile)) {
+    $modx->log(modX::LOG_LEVEL_ERROR, '[MiniShop3] manager_access_policy.php not found');
+
+    return false;
+}
+
+/** @var array<string, array<string, mixed>> $definitions */
+$definitions = require $definitionsFile;
+$template = $modx->getObject(modAccessPolicyTemplate::class, ['name' => 'miniShopManagerPolicyTemplate']);
+if (!$template instanceof modAccessPolicyTemplate) {
+    $modx->log(modX::LOG_LEVEL_WARN, '[MiniShop3] miniShopManagerPolicyTemplate not found; skip policy repair');
+
+    return true;
+}
+
+$templateId = (int) $template->get('id');
+
+foreach ($definitions as $name => $data) {
+    /** @var modAccessPolicy|null $policy */
+    $policy = $modx->getObject(modAccessPolicy::class, ['name' => $name]);
+    if ($policy instanceof modAccessPolicy) {
+        if ((int) $policy->get('template') !== $templateId) {
+            $policy->set('template', $templateId);
+            if (!$policy->save()) {
+                $modx->log(modX::LOG_LEVEL_ERROR, "[MiniShop3] Failed to link policy {$name} to template");
+
+                return false;
+            }
+            $modx->log(modX::LOG_LEVEL_INFO, "[MiniShop3] Linked existing policy {$name} to template");
+        }
+        // Existing policy data is left untouched by this resolver (no fromArray overwrite).
+        // Note: transport update.policies=true may still rewrite policy data on upgrade via xPDOObjectVehicle.
+        continue;
+    }
+
+    $payload = $data;
+    if (isset($payload['data']) && is_array($payload['data'])) {
+        $payload['data'] = json_encode($payload['data']);
+    }
+
+    $policy = $modx->newObject(modAccessPolicy::class);
+    $policy->fromArray(array_merge([
+        'name' => $name,
+        'lexicon' => 'minishop3:permissions',
+        'template' => $templateId,
+    ], $payload), '', true, true);
+
+    if ($policy->save()) {
+        $modx->log(modX::LOG_LEVEL_INFO, "[MiniShop3] Created access policy {$name}");
+        continue;
+    }
+
+    $modx->log(modX::LOG_LEVEL_ERROR, "[MiniShop3] Failed to create access policy {$name}");
+
+    return false;
+}
+
+return true;
diff --git a/core/components/minishop3/config/manager_access_policy.php b/core/components/minishop3/config/manager_access_policy.php
@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Default MiniShop3 manager access policy definition.
+ * Used by transport resolver and _build/elements/policies.php.
+ */
+$permissions = [
+    'mscategory_save',
+    'msproduct_save',
+    'msproduct_publish',
+    'msproduct_delete',
+    'msorder_save',
+    'msorder_view',
+    'msorder_list',
+    'msorder_remove',
+    'mssetting_save',
+    'mssetting_view',
+    'mssetting_list',
+    'msproductfile_save',
+    'msproductfile_generate',
+    'msproductfile_list',
+];
+
+return [
+    'miniShopManagerPolicy' => [
+        'description' => 'A policy for create and update MiniShop3 categories and products.',
+        'parent' => 0,
+        'class' => '',
+        'lexicon' => 'minishop3:permissions',
+        'data' => array_fill_keys($permissions, true),
+    ],
+];
diff --git a/core/components/minishop3/config/routes/manager.php b/core/components/minishop3/config/routes/manager.php
@@ -189,6 +189,7 @@
         new PermissionMiddleware($modx, 'view_document')
     ]);
 
+    // Extra fields reads: order/product forms load schema without settings perm (#613)
     $router->group('/extra-fields', function ($router) use ($modx) {
         $router->get('', function ($params) use ($modx) {
             $controller = new \MiniShop3\Controllers\Api\Manager\ExtraFieldsController($modx);
@@ -198,6 +199,10 @@
             $controller = new \MiniShop3\Controllers\Api\Manager\ExtraFieldsController($modx);
             return $controller->get($params);
         });
+    });
+
+    // Extra fields writes: schema mutations require mssetting_save (#381)
+    $router->group('/extra-fields', function ($router) use ($modx) {
         $router->post('', function ($params) use ($modx) {
             $controller = new \MiniShop3\Controllers\Api\Manager\ExtraFieldsController($modx);
             return $controller->create();
@@ -984,17 +989,41 @@
         new PermissionMiddleware($modx, 'mssetting_save')
     ]);
 
+    // Model fields schema reads: order/product forms load layout without settings perm (#613).
+    // Pure metadata — no combo source execution.
     $router->group('/model-fields', function ($router) use ($modx) {
         $router->get('/models', function ($params) use ($modx) {
             $controller = new \MiniShop3\Controllers\Api\Manager\ModelFieldsController($modx);
             return $controller->getModels();
         });
+
+        // Section routes
+        $router->get('/sections/{model}', function ($params) use ($modx) {
+            $controller = new \MiniShop3\Controllers\Api\Manager\ModelFieldsController($modx);
+            return $controller->getSections($params);
+        });
+
+        // Field routes
+        $router->get('', function ($params) use ($modx) {
+            $allParams = array_merge($_GET, $params);
+
+            $controller = new \MiniShop3\Controllers\Api\Manager\ModelFieldsController($modx);
+            return $controller->getList($allParams);
+        });
+        $router->get('/{id}', function ($params) use ($modx) {
+            $controller = new \MiniShop3\Controllers\Api\Manager\ModelFieldsController($modx);
+            return $controller->get($params);
+        });
+    });
+
+    // Model fields data reads: visible embeds comboOptions; combo-options executes sources
+    // (e.g. msCustomer PII). Require a form/settings permission — not mgr-auth alone (#613).
+    $router->group('/model-fields', function ($router) use ($modx) {
         $router->get('/visible/{model}', function ($params) use ($modx) {
             $controller = new \MiniShop3\Controllers\Api\Manager\ModelFieldsController($modx);
             return $controller->getVisibleFields($params);
         });
 
-        // Combo options routes
         $router->get('/combo-options/{model}', function ($params) use ($modx) {
             $controller = new \MiniShop3\Controllers\Api\Manager\ModelFieldsController($modx);
             return $controller->getComboOptions($params);
@@ -1003,12 +1032,22 @@
             $controller = new \MiniShop3\Controllers\Api\Manager\ModelFieldsController($modx);
             return $controller->getFieldComboOptions($params);
         });
+    }, [
+        new AnyPermissionMiddleware($modx, [
+            'msorder_list',
+            'msorder_view',
+            'msorder_save',
+            'msproduct_save',
+            'mscategory_save',
+            'mssetting_list',
+            'mssetting_view',
+            'mssetting_save',
+            'view_document',
+        ]),
+    ]);
 
-        // Section routes
-        $router->get('/sections/{model}', function ($params) use ($modx) {
-            $controller = new \MiniShop3\Controllers\Api\Manager\ModelFieldsController($modx);
-            return $controller->getSections($params);
-        });
+    // Model fields writes: schema mutations require mssetting_save (#381)
+    $router->group('/model-fields', function ($router) use ($modx) {
         $router->post('/sections', function ($params) use ($modx) {
             $input = file_get_contents('php://input');
             $data = json_decode($input, true) ?: [];
@@ -1036,17 +1075,6 @@
             return $controller->deleteSection($params);
         });
 
-        // Field routes
-        $router->get('', function ($params) use ($modx) {
-            $allParams = array_merge($_GET, $params);
-
-            $controller = new \MiniShop3\Controllers\Api\Manager\ModelFieldsController($modx);
-            return $controller->getList($allParams);
-        });
-        $router->get('/{id}', function ($params) use ($modx) {
-            $controller = new \MiniShop3\Controllers\Api\Manager\ModelFieldsController($modx);
-            return $controller->get($params);
-        });
         $router->post('', function ($params) use ($modx) {
             $input = file_get_contents('php://input');
             $data = json_decode($input, true) ?: [];