Problem/Motivation

The PrivateKeyStorageMigratorAccessCheck service was registered globally with:

- { name: access_check, applies_to: _custom_access } 

This causes the access checker to be executed for all routes using Drupal's _custom_access requirement, even when those routes are unrelated to Easy Encryption.

As a result, unrelated routes such as render endpoints can fail because the custom access checker is incorrectly invoked outside its intended scope.

This creates issues such as:

  • Broken render endpoints
  • Unexpected access validation behavior
  • Route handling conflicts with unrelated modules
  • Difficult debugging due to globally applied access logic

Proposed resolution

Remove the global access checker registration:

tags: - { name: access_check, applies_to: _custom_access } 

Keep the service available only for explicit usage where needed instead of automatically applying it to every route that uses _custom_access.

Benefits

  • Prevents unintended access checks on unrelated routes
  • Fixes render endpoint failures
  • Improves route isolation
  • Makes access control behavior more predictable

Remaining tasks

User interface changes

API changes

Data model changes

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

rajab natshah created an issue. See original summary.

rajab natshah’s picture

Assigned: rajab natshah » Unassigned
Status: Active » Needs review
dunx’s picture

Could be the cause of this access denied error when uploading media on a fresh install of Drupal CMS with the AI Assistant Recipe installed.

https://www.drupal.org/project/drupal_cms/issues/3590671

mxr576’s picture

I have just realized due to a Drupal Slack ping that I have not got notification about this issue (or it lost in my mailbox).
Will looking into this report in the next 24 hours and report back.

mxr576’s picture

Status: Needs review » Fixed

https://www.drupal.org/project/easy_encryption/releases/1.0.3 is out, terrible sorry about this bug

Also adjusted my project notification settings to make sure I do not miss new issues.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

mxr576’s picture

Status: Fixed » Closed (fixed)
dunx’s picture

Attempting to reproduce via the route shown in my duplicate issue at https://www.drupal.org/project/drupal_cms/issues/3590671
The new version 1.0.3 fixes the issue. I think I posted as this was being marked as Fixed, so all good.

mxr576’s picture

Thanks for reporting back!