Problem/Motivation

I encountered a fatal error during a deployment which originated from DecoratedUserRolesAccessPolicy::calculatePermissions(). The following code calls into UserRolesAccessPolicy::calculatePermissions():

    if (!$account instanceof TokenAuthUserInterface) {
      return $this->inner->calculatePermissions($account, $scope);
    }

This will load user role entities, which triggers entity storage hooks, which triggers hook discovery, which results in a fatal error because the modules providing the hooks are not available in the middle of a container initialization.

Steps to reproduce

The exact conditions to trigger this error might be hard to reproduce. In my project it happened when I was uninstalling a custom module during a config import. Immediately after the uninstallation of the module, the DIC is being rebuilt, and this caused the following fatal error to be logged, aborting the deployment:

   [notice] Synchronisierung von Erweiterungen: ekw_juicer deinstalliert.

  In ClassResolver.php line 32:
    Class "masquerade_entity_type_alter" does not exist.

When debugging the stack trace it was evident that the bug originates from the DecoratedUserRolesAccessPolicy::calculatePermissions() method which is called when the anonymous user permissions are being checked during the container rebuild.

Proposed resolution

Skip the calculation of the permissions during the config sync procedure.

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

pfrenssen created an issue. See original summary.

pfrenssen’s picture

Status: Active » Needs review
bojan_dev’s picture

Status: Needs review » Needs work

Looks good to me, please check the phpstan error, then we can merge this.

pfrenssen’s picture

Status: Needs work » Needs review

Sure! I will also set the phpstan job to fail if there is an error, so this is more obvious and cannot be ignored by the likes of me :)

  • bojan_dev committed 4477e28a on 6.1.x authored by pfrenssen
    fix: #3588717 Avoid permission calculation during config sync which...
bojan_dev’s picture

Status: Needs review » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.