Opening the code editor (/canvas/code-editor/component/*) crashes with a fatal error boundary if the current user does not have the "administer brand kit" permission.

Steps to reproduce

  1. Create a user role without the "administer brand kit" permission.
  2. Try to create a new component.
  3. The code editor crashes instead of loading.

Expected behavior

The code editor loads normally. Users without the brand kit permission should simply not see the brand kit sidebar panel, which is already correctly gated.

Actual behavior

useGetCodeEditorData fetches brand_kit/global unconditionally on every code editor load. When the API returns 403, errorGetBrandKit is set and showBoundary() is called, crashing the entire code editor.

Root cause

In useGetCodeEditorData.ts:

  • Around line 147–165: useGetAutoSaveQueryBrandKit is called with no permission guard — the brand kit API is always fetched regardless of whether the user has the brandKit permission.
  • Around line 199: isSuccess requires the brand kit fetch to succeed, blocking the editor from initializing.
  • Around line 220–222: Any brand kit error is passed to showBoundary(), making it a fatal crash.

The brand kit sidebar panel is correctly gated (!hasPermission('brandKit') || !devMode), but the underlying data fetch is not.

Proposed fix

Skip the brand kit fetch from auto-save when the user lacks the brandKit permission (mirror the existing panel permission gate)

Issue fork canvas-3581254

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

attilatilman created an issue. See original summary.

penyaskito made their first commit to this issue’s fork.

penyaskito’s picture

Issue summary: View changes
Status: Active » Needs review
penyaskito’s picture

Issue tags: +AI-accelerated

Disclosure: MR was Claude assisted. I reviewed it and understand every single line.

penyaskito’s picture

Priority: Normal » Critical
Issue tags: +Needs tests, +JavaScript

Tagging needs tests. This bug is quite annoying and blocking several stuff, so can definitely be in a follow-up MR.

justafish’s picture

Status: Needs review » Reviewed & tested by the community
Issue tags: -JavaScript +JavaScript
penyaskito’s picture

penyaskito’s picture

Fixed one of the flaky tests AI-assisted. I'm not even sure how this would ever pass.

But now: phpstan 2.1.43 released 1 hour ago, enough proof that the world hates me.

  • penyaskito committed 6d254e86 on 1.x
    fix(Theme builder): #3581254 Code editor crashes and throw error if user...
penyaskito’s picture

Assigned: Unassigned » justafish
Status: Reviewed & tested by the community » Needs work

Leaving open for a new test. I think @justafish has something, so assigning to her (feel free to unassign if I'm wrong)