Problem/Motivation

The "Layout Paragraphs Builder (Experimental)" formatter checks the builder access in LayoutParagraphsBuilderFormatter::view() and only keeps isAllowed():

if (!$entity->id() || !$this->layoutParagraphsBuilderAccess->access($this->account, $layout)->isAllowed() || $entity->in_preview) { ... }

The access result carries the cacheability of the field edit access and of the host entity update access, but the build returned by view() does not. The render cache and the Dynamic Page Cache therefore store the builder (the edit link, the data-lpb-id attribute and the builder libraries) without the cache contexts it depends on, and serve it to the next user with the same permissions.

With "Edit own content", node update access varies per user, so another editor with the same role gets the author's builder. Opening it is still denied, because the builder route runs the same access check, but the edit link and the libraries should not be there.

The "Layout Paragraphs" formatter already keeps the cacheability of its own access checks in _accessCacheability (LayoutParagraphsFormatter::view()).

Steps to reproduce

  1. Use the "Layout Paragraphs Builder (Experimental)" formatter (layout_paragraphs_builder) for a Layout Paragraphs field on a node type.
  2. Create a role with "Edit own content" for that node type and two users with that role.
  3. As the first user, create a node and view it: the builder is shown.
  4. As the second user, view the same node: the builder is shown too, served from cache. After a cache clear, the second user does not get it.

Proposed resolution

Keep the access result in view() and add it as a cacheable dependency to the returned build, on both branches: with the builder, and without it (#root_components).

The merge request fixes this and adds a Kernel test that checks the user cache context and the node cache tag on both builds, and a Cypress test that views a node as its author and then as another editor with the same role.

Remaining tasks

  • Review.

User interface changes

None.

API changes

None.

Data model changes

None.

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

tiago created an issue. See original summary.

tiago’s picture

MR !278 adds the cacheability of the builder access check to the build returned by the Layout Paragraphs Builder (Experimental) formatter, with a Kernel test and a Cypress test.

I have also attached the patch file here.

tiago’s picture

Status: Active » Needs review

  • justin2pin committed 9daa532c on 3.0.x authored by tiago
    Issue #3627291: Add the cacheability of the builder access check to the...
justin2pin’s picture

Status: Needs review » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.