Access denied when requesting a list of nodes with node/entity-access modules enabled

Can confirm that this solved the issue.
Nodes are shown in the listing respecting the node access permissions they have.

I agree with above comments and have added a patch.

This seems deprecated by #2237879: Remove custom restws_entity_node_access() hack.

As of now this is still an issue. The custom hack is gone but the code now checks the access using the entity API's entity_metadata_no_hook_node_access access callback. Which in turn (correctly) returns false when the access to ALL nodes is requested.

In certain use cases where a site has internal and external content where the external content should be accessible by anonymous users this will always fail as these users will never have access to all nodes or permissions to bypass node access. Making RestWS a useless module in these cases.

In my opinion this module should attempt to gain access to all nodes and when it fails, it could perhaps attempt to get view access to some nodes. I've altered the restws_handle_request function to do this below.

function restws_handle_request($op, $format, $resource_name, $id = NULL, $payload = NULL) {
  $message = $status_message = '';
  if ($resource = restws_resource_controller($resource_name)) {
    // Allow other modules to change the web service request or react upon it.
    $request = array(
      'op' => &$op,
      'format' => &$format,
      'resource' => &$resource,
      'id' => &$id,
      'payload' => &$payload,
    );
    drupal_alter('restws_request', $request);

    // Since there is no access callback for query we need to use view.
    $access_op = $op == 'query' ? 'view' : $op;

    if (user_access('access resource ' . $resource_name) && $resource->access($access_op, $id)) {
      try {
        $method = $op . 'Resource';
        if ($op == 'create') {
          print $format->$method($resource, $payload);
          $status_message = '201 Created';
        }
        elseif ($op == 'query') {
          if (!$resource instanceof RestWSQueryResourceControllerInterface) {
            throw new RestWSException('Querying not available for this resource', 501);
          }
          print $format->$method($resource, $payload);
        }
        else {
          print $format->$method($resource, $id, $payload);
        }
        drupal_add_http_header('Content-Type', $format->mimeType());
      }
      catch (RestWSException $e) {
        $message = check_plain($e->getHTTPError()) . ': ' . check_plain($e->getMessage());
        $status_message = $e->getHTTPError();
      }
    }
//
//
//
// Anonymous node read access begin
    elseif (user_access('access resource ' . $resource_name) && $op == 'query') {
      try {
        $method = $op . 'Resource';
        if (!$resource instanceof RestWSQueryResourceControllerInterface) {
          throw new RestWSException('Querying not available for this resource', 501);
        }
        print $format->$method($resource, $payload);
      }
      catch (RestWSException $e) {
        $message = check_plain($e->getHTTPError()) . ': ' . check_plain($e->getMessage());
        $status_message = $e->getHTTPError();
      }
    }
// Anonymous node read access end    
//
//
//
    else {
      $status_message = $message = '403 Forbidden';
      watchdog('access denied', check_plain($_GET['q']), NULL, WATCHDOG_WARNING);
    }
  }
  else {
    $status_message = $message = '404 Not Found';
  }

  restws_terminate_request($status_message, $message);
}

I'm experiencing this issue as well. The above change enables downloading lists of nodes. Would it make sense to roll it into a patch?

I made a patch of the above code to allow querying of entities by anonymous users.

Here is #5 in a patch.

Moving to needs review for testing.

Not sure why the patch in #8 is failing... everything applies cleanly for me. Someone want to give it another shot?

I found one bug with this patch. If im using any filters the url request gets redirected to node.json without the filters attached. For instance my filters are set as:

http://www.site.com/node?full=0&limit=10&type=blog

but anonymous users actually get:

http://www.site.com/node

More info on the bug.

It seems to only happen for people using the none json url structure. For instance

http://www.site.com/node?full=0&limit=10&type=blog BREAKS

http://www.site.com/node.json?full=0&limit=10&type=blog WORKS

This is a problem for people who are using http://www.site.com/node/ID however so we would need a way to fix that before considering it a working patch.

I've tested both of the patches above, and they seem to succeed or fail in similar situations. For example, we have a "People" content type that we use for directory entries. The following anonymous request succeeds:
mysite.com/node.json?type=people&limit=10
mysite.com/node.xml?type=people&limit=10

Sorting by the built-in node title also works:
mysite.com/node.json?type=people&limit=10&sort=title
mysite.com/node.xml?type=people&limit=10&sort=title

However, attempting to sort by a user-defined database field fails:
mysite.com/node.json?type=people&limit=10&sort=field_people_last_name
mysite.com/node.xml?type=people&limit=10&sort=field_people_last_name

...even though these work fine for an authenticated user. The PDOException is:
PDOException: SQLSTATE[42S22]: Column not found: 1054 Unknown column 'field_data_field_people_last_name0.nid' in 'where clause' in /var/www/drupal7-prod/htdocs/includes/database/database.inc on line 2171

I don't know enough about how restws handles permissions to know what's going on here. If it's helpful, the permissions-modifying module we're using on this site is the "View Unpublished" module.

having same thing here,

access denied even content type and restws permission set.

test url http://test1-bangkok.coconuts.co/node.json?type=event&field_price=420.13

any help is appreciated.

thanks
Keith

I'm having the same issue.

I have Content Access enabled and all the users that are not with "bypass content access control" permission cannot request the data.

I'm very interested in the solution.