8.x-1.7: hook_node_access_records adds view grants for published translations

Problem/Motivation

In 8.x-1.7, unpublished_node_permissions_node_access_records() was changed to iterate over all translations of a node. For each translation that is published, the implementation adds node_access rows with broadly permissive settings (e.g. realm = all, gid = 0, grant_view = 1, plus langcode).

https://git.drupalcode.org/project/unpublished_node_permissions/-/compar...

    else {
      $grants[] = [
        'realm' => 'all',
        'gid' => 0,
        'grant_view' => 1,
        'grant_update' => 0,
        'grant_delete' => 0,
        'langcode' => $langcode,
      ];
    }

That means this module is no longer limited to unpublished visibility. It is now injecting grant-table view access for published content, which is not what the project name or typical expectations suggest this module should do.

Published nodes are already subject to core and other contrib access logic. Adding extra node_access grants for published translations expands this module’s responsibility in a way that is easy to miss during upgrades and can interact badly with any site that relies on the node grant system together with other access checks (including but not limited to multi-domain or other entity-level rules).

Expected behavior
The module should only contribute node_access records that relate to viewing unpublished content (and the permissions this module defines for that). For published translations, it should not add compensating “everyone can view” grants. Published visibility should be left to core and other modules that already own that problem.

Actual behavior
8.x-1.7 adds node_access grants for published translations in addition to the grants for unpublished translations.

Proposed resolution

Restrict hook_node_access_records so it only emits grants when a translation is not published (similar to 8.x-1.6 for the default translation, extended per translation as needed).

Why this matters

8.x-1.7 addresses SA-CONTRIB-2026-029 (unpublished translations) but the same release adds node_access view grants for published translations, which is a scope this module never had before and can weaken other access controls.

Keeps the module’s behavior aligned with its purpose: unpublished node permissions, without silently changing node_access semantics for published content across the whole site.