Problem/Motivation
The PrivateKeyStorageMigratorAccessCheck service was registered globally with:
- { name: access_check, applies_to: _custom_access }
This causes the access checker to be executed for all routes using Drupal's _custom_access requirement, even when those routes are unrelated to Easy Encryption.
As a result, unrelated routes such as render endpoints can fail because the custom access checker is incorrectly invoked outside its intended scope.
This creates issues such as:
- Broken render endpoints
- Unexpected access validation behavior
- Route handling conflicts with unrelated modules
- Difficult debugging due to globally applied access logic
Proposed resolution
Remove the global access checker registration:
tags: - { name: access_check, applies_to: _custom_access }
Keep the service available only for explicit usage where needed instead of automatically applying it to every route that uses _custom_access.
Benefits
- Prevents unintended access checks on unrelated routes
- Fixes render endpoint failures
- Improves route isolation
- Makes access control behavior more predictable
Remaining tasks
User interface changes
API changes
Data model changes
Issue fork easy_encryption-3589914
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #3
rajab natshahComment #4
dunx commentedCould be the cause of this access denied error when uploading media on a fresh install of Drupal CMS with the AI Assistant Recipe installed.
https://www.drupal.org/project/drupal_cms/issues/3590671
Comment #5
mxr576I have just realized due to a Drupal Slack ping that I have not got notification about this issue (or it lost in my mailbox).
Will looking into this report in the next 24 hours and report back.
Comment #7
mxr576https://www.drupal.org/project/easy_encryption/releases/1.0.3 is out, terrible sorry about this bug
Also adjusted my project notification settings to make sure I do not miss new issues.
Comment #9
mxr576Comment #10
dunx commentedAttempting to reproduce via the route shown in my duplicate issue at https://www.drupal.org/project/drupal_cms/issues/3590671
The new version 1.0.3 fixes the issue. I think I posted as this was being marked as Fixed, so all good.
Comment #11
mxr576Thanks for reporting back!