Open an evidence record only for whoever may see its content

Generated with the help of an LLM.

Problem/Motivation

The evidence archive (#3634256, #3634263, #3634272) hands a record out on two routes: the document as JSON at /admin/reports/content-credentials/evidence/{id} and the readable view at .../evidence/{id}/view. Both check only the permission View content credentials evidence. Record IDs are a serial.

So a user with that permission can open the record of content they may not see, such as another user's unpublished node or a node behind a node-access module. The record says which file was read for that content, when, with which verdict, and, while the document is kept, the certificates of whoever signed the file, which can name a person.

The block on the edit form looks records up by file, not by entity. A file referenced by two pieces of content shows, on A's form, the record read for B.

This is only on 1.0.x-dev: the archive is in no release yet.

Proposed resolution

• Both routes also require view access to the entity the record was read for. This is a route access check, so a link can ask Url::access() before it is shown. A refused record answers 403.
• A record whose entity was deleted, or whose entity type no longer exists, opens only for Administer content credentials.
• The edit-form block lists only records read for the entity being edited.

Out of scope: the trust-list download, which serves the site's own configured anchors and is tied to no content; a list page of records; revision-level access.

Remaining tasks

Failing tests, then the implementation.

User interface changes

The edit-form block no longer lists records read for other content.

API changes

A route access check on the two evidence routes.

Data model changes

None.