[5.x] Allow accessing drafts via the REST API with Live Preview

src/Http/Controllers/API/ApiController.php

@@ -3,6 +3,7 @@
 namespace Statamic\Http\Controllers\API;
 
 use Facades\Statamic\API\ResourceAuthorizer;
+use Illuminate\Http\Request;
 use Statamic\Exceptions\ApiValidationException;
 use Statamic\Exceptions\NotFoundHttpException;
 use Statamic\Facades\Site;
@@ -23,8 +24,16 @@ class ApiController extends Controller
      *
      * @param  mixed  $item
      */
-    protected function abortIfUnpublished($item)
+    protected function abortIfUnpublished(Request $request, $item)
     {
+        if ($request->statamicToken()) {
+            return;
+        }
+
+        if ($request->boolean('draft') && in_array('status', $this->allowedFilters())) {
+            return;
+        }
+
         throw_if($item->published() === false, new NotFoundHttpException);
     }
 

src/Http/Controllers/API/CollectionEntriesController.php

@@ -3,6 +3,7 @@
 namespace Statamic\Http\Controllers\API;
 
 use Facades\Statamic\API\FilterAuthorizer;
+use Illuminate\Http\Request;
 use Statamic\Exceptions\NotFoundHttpException;
 use Statamic\Facades\Entry;
 use Statamic\Http\Resources\API\EntryResource;
@@ -33,14 +34,15 @@ public function index($collection)
         );
     }
 
-    public function show($collection, $handle)
+    public function show(Request $request, $collection, $handle)
     {
         $this->abortIfDisabled();
 
         $entry = Entry::find($handle);
+        $this->collectionHandle = $entry?->collectionHandle();
 
         $this->abortIfInvalid($entry, $collection);
-        $this->abortIfUnpublished($entry);
+        $this->abortIfUnpublished($request, $entry);
 
         return app(EntryResource::class)::make($entry);
     }

tests/API/APITest.php

@@ -53,6 +53,31 @@ public static function entryNotFoundProvider()
         ];
     }
 
+    /** @test */
+    public function it_handles_unpublished_entries()
+    {
+        Facades\Config::set('statamic.api.resources.collections', [
+            'pages' => [
+                'allowed_filters' => ['status'],
+            ],
+        ]);
+
+        Facades\Collection::make('pages')->save();
+        Facades\Collection::make('articles')->save();
+
+        Facades\Entry::make()->collection('pages')->id('about')->slug('about')->published(false)->save();
+
+        $this->get('/api/collections/pages/entries/about')->assertJson([
+            'message' => 'Not found.',
+        ]);
+
+        $this->get('/api/collections/pages/entries/about?draft=true')->assertJson([
+            'data' => [
+                'id' => 'about',
+            ],
+        ]);
+    }
+
     public static function exampleFiltersProvider()
     {
         return [['status:is'], ['published:is'], ['title:is']];
@@ -432,6 +457,26 @@ public function it_replaces_entries_using_live_preview_token()
         ]);
     }
 
+    /** @test */
+    public function live_preview_token_bypasses_entry_status_check()
+    {
+        Facades\Config::set('statamic.api.resources.collections', true);
+        Facades\Collection::make('pages')->save();
+        $entry = tap(Facades\Entry::make()->collection('pages')->id('dance')->published(false)->set('title', 'Dance')->slug('dance'))->save();
+
+        $this->get('/api/collections/pages/entries/dance')->assertJson([
+            'message' => 'Not found.',
+        ]);
+
+        LivePreview::tokenize('test-token', $entry);
+
+        $this->get('/api/collections/pages/entries/dance?token=test-token')->assertJson([
+            'data' => [
+                'title' => 'Dance',
+            ],
+        ]);
+    }
+
     /** @test */
     public function it_replaces_terms_using_live_preview_token()
     {