Problem/Motivation

Two methods copy core JSON:API method bodies nearly verbatim, by design:

  • EntityResource::createIndividual() inlines the tail of core's method (field-access loop, validate, 409, save, response build, ~70 lines), because released core re-deserializes and would discard the injected langcode.
  • EntityAccessChecker::getAccessCheckedResourceObject() copies core's method with a single line rerouted through the getEntityTranslation() seam.

Both carry UPSTREAM(core): markers, and the project policy is to re-check every fork on each core update. But nothing TELLS a maintainer that core's originals changed: if core lands a security or correctness fix inside those bodies, the fork silently keeps the old behaviour until someone happens to diff it.

Steps to reproduce

Proposed resolution

A kernel test (CoreForkDriftTest) that fingerprints CORE's two methods via reflection (whitespace-normalized sha256 of the method source) against recorded constants. When core changes either method in any way, the test fails with a message naming both sides (core original, module fork and its marker) and echoing the new fingerprint to record after re-syncing. False positives from core comment reflows are acceptable: each one is a legitimate "go look" moment. Both UPSTREAM(core): docblocks reference the guard.

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

lauriii created an issue.