Authenticated role is granted admin permissions, so users with no role see the Navigation sidebar

Problem/Motivation

The recipe grants the authenticated role five admin permissions. A logged-in user with no other role sees the Navigation sidebar and the top bar on the front end, and can open the admin pages listing.

• access administration pages
• access coffee
• access contextual links
• access navigation
• view the administration theme

Every Varbase editorial role (Content editor, Content admin, SEO admin, Site admin) already grants all five itself, and Administrator has every permission, so authenticated does not need them. They came in with #3576659. Varbase 10.1.x is not affected: its authenticated role has no permissions.

Steps to reproduce

1. Install Varbase 11.0.x.
2. Create a user with no roles.
3. Log in as that user and visit /user.
4. The Navigation sidebar and the top bar show.

Environment: Drupal 11.4.9, Varbase 11.0.x-dev, Varbase Admin Base 1.0.x-dev, PHP 8.4, MariaDB 11.8 (DDEV).

Before:

After the change below:

Proposed resolution

Reduce user.role.authenticated: grantPermissions: in recipe.yml to 'view any term' only.

Recipes cannot revoke, so existing sites keep the permissions until removed by hand:

drush role:perm:remove authenticated 'access administration pages,access coffee,access contextual links,access navigation,view the administration theme'

Remaining tasks

• ✅ File an issue
• ✅ Addition/Change/Update/Fix
• ✅ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ✅ Credit contributors
• ❌ Review with the product owner
• ✅ Update Release Notes
• ✅ Release varbase_admin_base-1.0.7

User interface changes

• Users with only the authenticated role no longer see the Navigation sidebar, the top bar or the admin pages listing.

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• Stop granting the authenticated role admin permissions, so a logged-in user with no other role no longer sees the Navigation sidebar and top bar.

AI-Generated: Yes