Problem/Motivation

The access check in LatestRevisionCheck::access() returns AccessResult::forbidden() if no access is granted. This makes it impossible for contrib (or custom) modules to further grant access should desired conditions be met.

For example, the Workflow Participants or Group modules that might wish to allow a group member to moderate content only in their groups, it currently isn't possible for those to grant access to the latest revision tab.

Note: the workflow participants module actually does have a workaround for this, but it completely swaps out the access checker to its own. When coupled with other modules that might want to do this, it becomes unmaintainable.

Proposed resolution

Have this access check return AccessResult::neutral() instead. The tab won't appear when it shouldn't unless code elsewhere explicitly grants access.

Remaining tasks

Update the code and tests.

User interface changes

API changes

Data model changes

Comments

jhedstrom created an issue. See original summary.

jhedstrom’s picture

jhedstrom
Primary language English
Location Portland, OR
commented
Issue summary: View changes
jhedstrom’s picture

jhedstrom
Primary language English
Location Portland, OR
commented
Assigned: jhedstrom » Unassigned
Status: Active » Closed (works as designed)

Hmm, actually I don't think this matters since the route's access is checked by AccessManager::check(), which uses andIf() to put the access requirements together, so even if one comes back as allowed, if one is neutral then access is still denied. I think this will have to be fixed in each module that wants to override this by completely replacing the default access requirement for the route...

sam152’s picture

sam152 commented

That is really surprising. I would imagine "neutral" and "allowed" would end up "allowed", but according to AccessResultInterface::andIf, you're right:

   *   |A N F
   * --+-----
   * A |A N F
   * N |N N F
   * F |F F F