fix(api): return a full batch response when one request is forbidden

An AccessDeniedException raised by a single request was relayed out of the
batch loop, so the whole call answered with one error object instead of the
array of responses required by the JSON-RPC spec. Authentication failures
still fail the whole call.

Fixes #3879

libs/jsonrpc/src/JsonRPC/Request/BatchRequestParser.php

@@ -2,6 +2,9 @@
 
 namespace JsonRPC\Request;
 
+use JsonRPC\Exception\AccessDeniedException;
+use JsonRPC\Response\ResponseBuilder;
+
 /**
  * Class BatchRequestParser
  *
@@ -21,12 +24,21 @@ class BatchRequestParser extends RequestParser
         $responses = array();
 
         foreach ($this->payload as $payload) {
-            $responses[] = RequestParser::create()
-                ->withPayload($payload)
-                ->withProcedureHandler($this->procedureHandler)
-                ->withMiddlewareHandler($this->middlewareHandler)
-                ->withLocalException($this->localExceptions)
-                ->parse();
+            try {
+                $responses[] = RequestParser::create()
+                    ->withPayload($payload)
+                    ->withProcedureHandler($this->procedureHandler)
+                    ->withMiddlewareHandler($this->middlewareHandler)
+                    ->withLocalException($this->localExceptions)
+                    ->parse();
+            } catch (AccessDeniedException $e) {
+                //Bad credentials still fail the whole call, but a forbidden
+                //resource concerns only the request that asked for it
+                $responses[] = ResponseBuilder::create()
+                    ->withId(isset($payload['id']) ? $payload['id'] : null)
+                    ->withException($e)
+                    ->build();
+            }
         }
 
         $responses = array_filter($responses);