## Summary `AiContextSubcontextResolver::batchLoadChildren()` loads published children with `accessCheck(TRUE)`. For this entity type, that query check does not apply `access('view')` or the scope hard filters, because context items have no query access handler yet (#3586380+s). A child with its own scope, such as Roles = Editor, is delivered to every account that receives the parent. This affects the selector path, the Load tool, and the conditional decision prompt that is sent to the AI provider. Part of #3586615+s. Target: 1.0.0. ## Proposed resolution - Drop a child the current account cannot view, or whose delivered translation is not published. Check access on the translation the caller delivers, so a published translation of a draft child is kept in that language. `resolve()` gets an optional language code, and the selector and the Load tool pass theirs. - Hard-filter children that have their own scope, with `filterByRequestContext()`. This covers Roles, Languages, Site Sections, Entity Types, Taxonomy Terms, and Specific Entities. - Do not hard-filter children that inherit the parent scope. Their parent was already selected, including through Always include or Load. This differs from the first plan, which dropped these children; dropping them would change delivery without closing a leak. - Let an Always include child skip hard filters, like any Always include item, but still require view access. - Filter before the conditional decision, so filtered children are never sent to the provider. - Add the language to the conditional decision cache key, and merge the child access cacheability into the selection result. ## Remaining tasks - [x] Kernel: own-scope Roles child dropped, inheriting child kept (`AiContextSubcontextResolverTest`). - [x] Kernel: child denied by `hook_entity_access()` dropped on the selector and Load paths. - [x] Kernel: Always include child skips hard filters but needs view access. - [x] Kernel: filtered conditional child is not sent to the provider (call count and prompt text). - [x] Kernel: published translation of a draft child is delivered in that language, and the draft is not delivered in the source language. - [x] Kernel: the conditional provider uses the delivered translation, and the decision cache varies by language. - [x] EchoAI kernel: an agent prompt contains a Roles-restricted child only for that role. - [x] Docs: `docs/features/subcontext.md`. - [x] Release note. - [x] Confirm that the new tests fail on 1.0.x, and list the test count correctly in the MR text. With the 1.0.x source files, 9 of the 11 `AiContextSubcontextChildAccessTest` runs fail, and the new Resolver and EchoAI tests fail. The two that pass on 1.0.x check that the new checks do not drop a published translation or leak an archived one. - [x] After the unpublished-translation fix (#3586616+s) merges: in `filterDeliverableChildren()`, skip a child when `$rendered->isPublished()` is FALSE, before the access check. Do not use `translateItems()` there, because it checks access as a boolean and drops the child access cacheability. - [x] Kernel: as an account that can view Drafts, a conditional child with a Draft source and a published French translation is not sent to the provider for a request in the source language. The test covers **Administer AI Context**, **View any unpublished AI Context Item**, and the owner with **View AI Context items**. Each case fails without the check. - [x] Manual check: a user without the Editor role does not get an Editor-only child. Checked on the selector and Load paths, with a Roles = Content editor child. - [x] Open the MR: !376. ## Release note Subcontext children are now checked before they are delivered with a parent, on both the selector path and the Load tool. Every child is checked on the translation that is delivered: that translation must be published, and the current user must be able to view it. A child with its own scope must also pass the hard filters (for example, Roles) for the current request. A child that fails these checks is no longer sent to the AI provider for the conditional decision. Children that use the parent's scope behave as before. Sites that rely on a custom-scope child reaching users outside its scope must change the child's scope. ## Environment - Module version: found on 1.0.0-rc1 (8a57807). The fix is checked on 1.0.x after #3586616+s and #3586664+s (`2da663ed`). > [!note] > Check the one that best describes your usage, or leave all unchecked if AI was not significantly used. > > * [ ] AI **Assisted Issue** \ > _Mainly written by a human; AI used for partial generation under full human supervision._ > > * [x] AI **Generated Issue** \ > _Mainly generated by AI, reviewed and approved by a human before this issue was created._