Categories and search

In strict mode, Custom Catalog filters category collections and storefront search against the current customer's allowed products. The direct product URL is the final access check: a customer who is not allowed to view the product is sent to the configured no-route page.

Search engines maintain their own indexes, so assignment changes and catalog data must be tested after the relevant Magento indexers have completed. Customer access is applied to the storefront request even though the underlying search index is shared.

After changing a large assortment:

1. run the relevant Magento indexers;
2. clear application and full-page cache;
3. sign in with a fresh customer session;
4. test category, search and direct URL access;
5. check the cart if products were removed from the assortment.

If search still lists a restricted product but its product page is denied, do not treat the search result as proof of access. Rebuild Catalog Search, clear the caches and repeat the test with a new customer session. Check the direct URL again after the search result is clean.

When the Pricesystem extension is installed, the same strict whitelist also filters the requested product IDs on Pricesystem's storefront price endpoints, so disallowed products return no price data through that path either.

See caching and indexing for a focused checklist.