Problem/Motivation
The "Layout Paragraphs Builder (Experimental)" formatter checks the builder access in LayoutParagraphsBuilderFormatter::view() and only keeps isAllowed():
if (!$entity->id() || !$this->layoutParagraphsBuilderAccess->access($this->account, $layout)->isAllowed() || $entity->in_preview) { ... }
The access result carries the cacheability of the field edit access and of the host entity update access, but the build returned by view() does not. The render cache and the Dynamic Page Cache therefore store the builder (the edit link, the data-lpb-id attribute and the builder libraries) without the cache contexts it depends on, and serve it to the next user with the same permissions.
With "Edit own content", node update access varies per user, so another editor with the same role gets the author's builder. Opening it is still denied, because the builder route runs the same access check, but the edit link and the libraries should not be there.
The "Layout Paragraphs" formatter already keeps the cacheability of its own access checks in _accessCacheability (LayoutParagraphsFormatter::view()).
Steps to reproduce
- Use the "Layout Paragraphs Builder (Experimental)" formatter (
layout_paragraphs_builder) for a Layout Paragraphs field on a node type. - Create a role with "Edit own content" for that node type and two users with that role.
- As the first user, create a node and view it: the builder is shown.
- As the second user, view the same node: the builder is shown too, served from cache. After a cache clear, the second user does not get it.
Proposed resolution
Keep the access result in view() and add it as a cacheable dependency to the returned build, on both branches: with the builder, and without it (#root_components).
The merge request fixes this and adds a Kernel test that checks the user cache context and the node cache tag on both builds, and a Cypress test that views a node as its author and then as another editor with the same role.
Remaining tasks
- Review.
User interface changes
None.
API changes
None.
Data model changes
None.
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | layout_paragraphs-builder_formatter_access_cacheability-3627291-3.patch | 8.45 KB | tiago |
Issue fork layout_paragraphs-3627291
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #3
tiago commentedMR !278 adds the cacheability of the builder access check to the build returned by the Layout Paragraphs Builder (Experimental) formatter, with a Kernel test and a Cypress test.
I have also attached the patch file here.
Comment #4
tiago commentedComment #6
justin2pin commented