Lower roles can generate tokens for any node.

Problem/Motivation

Seems like multiple issues here so unclear which is most important.

I have a non-admin role editing an unpublished node that they own. The form includes the Access unpublished subform to set lifetime and generate a token.

To start with, i have no intent of ever using AU on this bundle and this role should never be allowed to see this form on ANY bundle (even the 1 bundle i do use this module for).

I see no perms related to who can access anything other than the unpublished node itself (and this bundle isnt selected, but this isnt the view anyway, this is the edit form). And there is no setting as to what bundles this applies to. For now i think i can form alter and set this subform access to false, but seems like a pretty glaring bug.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes