Changelog

Current version: 1.0.0

All notable changes to the Qoliber Login Only Catalog module are documented here. The format is based on Keep a Changelog, and the module adheres to Semantic Versioning. The Hyvä templates ship in qoliber/login-only-catalog-hyva, released alongside.

[1.0.0] - 2026-10-20

Added

• Website-scoped login-only catalog: guests opening category, product, search, review, RSS, cart or checkout pages are redirected to the login page and return to that page after signing in.
• Product blocks on other pages (widgets, lists, cross-sells, related and up-sells) show a sign-in notice to guests.
• Strict private mode: guests see no categories in menus.
• Anonymous catalog REST routes (/V1/products-render-info, /V1/search) and guest cart reads answer 401 to guests; GraphQL catalog queries, compare lists, guest carts and product/category routes return an authorization error.
• Guest carts take no products and cannot be ordered while the catalog is restricted (also carts filled before).
• Access packages: ranges of categories that only customers with a grant can see and, when included, buy; hidden from listings, search totals and facets, menus, widgets, REST, GraphQL, carts, order placement and the sitemap.
• Access requests with a buyer access center (My Account > Catalog Access), an admin approval queue, one pending request per package, a retry interval after a decline and at most 10 requests per customer a day (dailyRequestLimit).
• Temporary invitations: single-use, recipient-bound, hashed links that give time-limited access (browse-only by default) when the signed-in recipient activates them.
• Shopping continuity: the page a buyer wanted (with filters and sorting) is kept through login and approval.
• Admin: Customers > Catalog Access (requests, grants, invitations, packages) with their own ACL resources.
• Emails: new request (to the merchant), decision (to the buyer), invitation (to the recipient).
• Integration tests (Test/Integration) and a Playwright suite (Test/Playwright) for the storefront, admin screens, APIs and Varnish.
• Hyvä support (Hyvä 1.2 to 1.5, Tailwind CSS 3 or 4) through the separate qoliber/login-only-catalog-hyva package.
• blockNames DI argument: cache keys of listed template blocks include the caller's access. Block caches are keyed by packages, so customers with the same packages share cached menus and widgets.
• The access services reset per request (ResetAfterRequestInterface) for application servers.
• Requirements: Magento Open Source 2.4.7 or later (magento/framework 103.0.7), or Mage-OS 3.x. Adobe Commerce (with its own catalog permissions and B2B shared catalogs) has not been tested.
• Built-in page cache: signed-in customers of a login-only website (or with grants) are never served a cached guest page, also on the 2.4.7/2.4.8 patches that look cached pages up without the vary cookie.
• Package changes made at the same time by several administrators are saved without database deadlocks.
• Admin grids: the Customer filter of Access Grants and Access Requests; invitations past their end show as Expired. Grant lengths and the websites and categories of a package are checked when saved.
• Emails show the invitation's end in the store view's time zone; decisions are sent from the buyer's store view and name the package also when it is no longer active.

Security

• Pages rendered for signed-in customers of a login-only website, or for customers with access packages, are never stored in shared caches, so copied X-Magento-Vary cookies or GraphQL cache IDs cannot replay them; the built-in page cache ignores a vary cookie without a signed-in session, and a guest's cache lookup starts no session.
• Every page that shows one product checks access: wish list and cart item configuration, single reviews and posting a review. Gated products cannot be added to wish lists (storefront and GraphQL).
• Multishipping orders are checked for access like one-page checkout orders.
• REST products-render-info and RSS feeds refuse another website's protected store view; RSS feeds of hidden categories answer 404.
• GraphQL: category children leave out gated subcategories; the deprecated urlResolver is restricted like route; the server-side resolver cache of cmsPage and cmsBlocks is kept apart by access packages.
• Guest-cart REST and SOAP reads that return items or totals (cart, totals information, payment and shipping information) answer 401 to guests of a login-only website.
• Changing a switch cleans the block cache as well (cached menus); category changes rebuild the gated catalog after the database commit.
• Requests and invitations cannot be used while access packages are switched off on the website.
• The admin package, grant and invitation forms check their ACL resource also when loaded through the UI renderer.