JSON:API: Status filter by jurisdiction returns all terms (Group entity traversal fails)

[markaspot]

Problem

The JSON:API endpoint for status taxonomy terms ignores the field_jurisdiction filter for anonymous users. Instead of returning only the status terms for the current jurisdiction (typically 4-5 terms), it returns all 55 status terms across all jurisdictions.

Root Cause

Status terms (taxonomy_term--service_status) are linked to jurisdictions via field_jurisdiction, which references a Group entity. The JSON:API filter:

filter[field_jurisdiction.meta.drupal_internal__target_id]=1

silently fails because anonymous users lack permission to traverse the Group entity reference. Drupal's JSON:API does not return an error. It simply ignores the filter and returns all terms.

Impact

• Status filter pills on the dashboard requests page show duplicates (e.g., 10x "Open", 10x "Closed") because each jurisdiction/organization creates its own status terms with identical names but different TIDs.
• Performance: 55 terms fetched instead of 4-5.

Current Workaround

Frontend deduplication by name in useStatus.ts:

const seen = new Set<string>();
statusItems.value = response.data.filter((item) => {
    const name = item.attributes.name;
    if (seen.has(name)) return false;
    seen.add(name);
    return true;
});

This works but masks the underlying issue. The API should return the correct subset.

Expected Behavior

The JSON:API filter should work for anonymous users and return only the status terms belonging to the requested jurisdiction.

Possible Solutions

1. Custom JSON:API resource that bypasses Group permission checks for taxonomy term filtering
2. Views-based REST endpoint for status terms filtered by jurisdiction (avoids JSON:API entity access checks)
3. Grant anonymous users permission to view Group entity references (security implications to evaluate)
4. Custom route/controller that returns filtered status terms without JSON:API constraints