Problem/Motivation

When a chatbot block (e.g. ai_chatbot_block) has a request path visibility condition configured (e.g. only show on /chatbot), the AJAX callback that loads the chatbot content after cookie consent always fails with:

Exception: Access denied for block 'my_block_id'. in Drupal\cookies_addons_chatbot\Controller\CookiesAddonsChatbotController->getChatbot() (line 71)

This happens because CookiesAddonsChatbotController::getChatbot() usesm $block->access('view') on line 69, which evaluates all access conditions of the block entity, including visibility conditions like request_path.

The AJAX request is sent to /cookies-addons-chatbot/get-chatbot/{block_id}/{service}, so the request_path visibility condition is evaluated against this AJAX route — not against the original page where the block was displayed. Since the AJAX path never matches the configured visibility path, access is always denied.

The visibility condition was already evaluated when the page was initially rendered — that is how the placeholder got there in the first place. Re-evaluating it during the AJAX callback is redundant and incorrect.

Steps to reproduce

1. Place an ai_chatbot_block in a region.
2. Add a request path visibility condition (e.g. /chatbot).
3. Enable cookies_addons_chatbot and configure the chatbot cookie service.
4. Visit /chatbot — the consent placeholder is displayed correctly.
5. Accept the chatbot cookies.
6. The AJAX call to /cookies-addons-chatbot/get-chatbot/{block_id}/chatbot
returns a 500 error with "Access denied for block '{block_id}'."

Proposed resolution

Replace $block->access() with $block->getPlugin()->access() in CookiesAddonsChatbotController::getChatbot(). This checks only the block plugin's own access (e.g. permissions) without re-evaluating entity-level visibility conditions that were already checked during page rendering.

  // Before:
  $access = $block->access('view', $this->currentUser(), TRUE);

  // After:
  $plugin = $block->getPlugin();
  $access = $plugin->access($this->currentUser(), TRUE);

Remaining tasks

Implement
Review

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

scontzen created an issue. See original summary.

scontzen’s picture

Assigned: scontzen » guido_s
Status: Active » Needs review
guido_s’s picture

Looks good to me but we need to merge it against a 2.0.x branch that is about to be created.
So we need to wait until @shy_ finished his work on this.

guido_s’s picture

Version: 1.3.2 » 2.0.x-dev
guido_s’s picture

Status: Needs review » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • guido_s committed f9a1fea0 on 2.0.x authored by scontzen
    feat: #3575965 AJAX callback fails with "Access denied" for blocks with...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.