PHP service contracts

The base Custom Catalog module contains service contracts for named catalogs, product membership, customer assignments, customer-group assignments and direct customer-product grants. Magento modules can use these contracts without calling controllers or writing assignment tables directly.

REST exposure belongs to the optional Custom Catalog API package. The REST package manages named catalogs and their assignments. It does not expose the base module's direct customer-product repository.

Use repositories and assignment services so cache context, customer access versions and cart refresh behavior remain consistent after writes.

Where access is enforced

The strict-mode whitelist is not only a storefront filter. It is enforced wherever a product can be added to a cart:

• the storefront catalog and category listings (see Search and category filtering);
• the add-to-cart path in the storefront, REST, GraphQL and Admin order/cart creation — a plugin on the quote's add-product check rejects products outside the customer's allowed set;
• related, up-sell and cross-sell product collections and catalog search (including advanced search and ID filters).

An integration that must apply its own decision can listen to the customcatalog_quote_product_access_validate event, which the add-product plugin dispatches before rejecting a product.