From 8a792f85db6394df7320d66925000e7b94272e7d Mon Sep 17 00:00:00 2001
From: Coleman Watts <coleman@civicrm.org>
Date: Fri, 7 Oct 2022 11:45:56 -0400
Subject: [PATCH] APIv4 - Don't show custom fields from disabled groups
 (affects SearchKit)

---
 Civi/Api4/Service/Spec/SpecGatherer.php       |  3 +-
 .../v4/Custom/CustomFieldGetFieldsTest.php    | 32 +++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/Civi/Api4/Service/Spec/SpecGatherer.php b/Civi/Api4/Service/Spec/SpecGatherer.php
index ec74bac3a5..3a79e2cd70 100644
--- a/Civi/Api4/Service/Spec/SpecGatherer.php
+++ b/Civi/Api4/Service/Spec/SpecGatherer.php
@@ -125,7 +125,8 @@ class SpecGatherer extends AutoService {
     $query = CustomField::get(FALSE)
       ->setSelect(['custom_group_id.name', 'custom_group_id.title', '*'])
       ->addWhere('is_active', '=', TRUE)
-      ->addWhere('custom_group_id.is_multiple', '=', '0');
+      ->addWhere('custom_group_id.is_active', '=', TRUE)
+      ->addWhere('custom_group_id.is_multiple', '=', FALSE);
 
     // Contact custom groups are extra complicated because contact_type can be a value for extends
     if ($entity === 'Contact') {
diff --git a/tests/phpunit/api/v4/Custom/CustomFieldGetFieldsTest.php b/tests/phpunit/api/v4/Custom/CustomFieldGetFieldsTest.php
index 5b2e3a91a1..064a7cf8ef 100644
--- a/tests/phpunit/api/v4/Custom/CustomFieldGetFieldsTest.php
+++ b/tests/phpunit/api/v4/Custom/CustomFieldGetFieldsTest.php
@@ -19,6 +19,7 @@
 
 namespace api\v4\Custom;
 
+use Civi\Api4\Activity;
 use Civi\Api4\Contact;
 use Civi\Api4\ContactType;
 use Civi\Api4\CustomField;
@@ -49,6 +50,37 @@ class CustomFieldGetFieldsTest extends CustomTestBase {
       ->execute();
   }
 
+  public function testDisabledFields() {
+    // Create a custom group with one enabled and one disabled field
+    CustomGroup::create(FALSE)
+      ->addValue('extends', 'Activity')
+      ->addValue('title', 'act_test_grp')
+      ->execute();
+    $this->saveTestRecords('CustomField', [
+      'records' => [
+        ['label' => 'enabled_field'],
+        ['label' => 'disabled_field', 'is_active' => FALSE],
+      ],
+      'defaults' => ['custom_group_id.name' => 'act_test_grp'],
+    ]);
+
+    // Only the enabled field shows up
+    $getFields = Activity::getFields(FALSE)->execute()->column('name');
+    $this->assertContains('act_test_grp.enabled_field', $getFields);
+    $this->assertNotContains('act_test_grp.disabled_field', $getFields);
+
+    // Disable the entire custom group
+    CustomGroup::update(FALSE)
+      ->addWhere('name', '=', 'act_test_grp')
+      ->addValue('is_active', FALSE)
+      ->execute();
+
+    // Neither field shows up as the whole group is disabled
+    $getFields = Activity::getFields(FALSE)->execute()->column('name');
+    $this->assertNotContains('act_test_grp.enabled_field', $getFields);
+    $this->assertNotContains('act_test_grp.disabled_field', $getFields);
+  }
+
   public function testCustomGetFieldsWithContactSubType() {
     ContactType::create(FALSE)
       ->addValue('name', $this->subTypeName)
-- 
2.25.1