## Summary On `1.0.x`, `AiContextItemAccessControlHandler::checkAccess()` returns a neutral result for `view` of an unpublished context item when no context item rule allows it (`src/Entity/AiContextItemAccessControlHandler.php`, lines 165 and 169). A neutral result does not deny access. Other modules can still allow it. Content Moderation is a required dependency of this module. Its `hook_entity_access()` implementation (`ContentModerationHooks::entityAccess()` in Drupal 11) allows `view` of every unpublished entity that implements `EntityPublishedInterface` when the user has core's **View any unpublished content** permission. This grant also applies to context items. The result: * A user with only **View any unpublished content** can open draft and archived items on the item page, `/admin/config/ai/context/items/{id}`. * A user with **View any unpublished content** and **View the latest version** can open the pending draft of a published item on the **Latest version** tab, `/admin/config/ai/context/items/{id}/latest`. * A user with **View any unpublished content** and **View all AI Context Item revisions** can open the revision history, `/admin/config/ai/context/items/{id}/revisions`, and the revision pages of draft and archived items. If the user also has **Use Published AI Context in AI Features**, the user can open the pending draft revision of a published item. The revision access checks use `view` access on the item and on the revision. * When the Diff module is installed (8.x-1.x, 2.0.0, or 2.1.0), a user with only **View any unpublished content** can open the revision compare page of a draft or archived item, `/admin/config/ai/context/items/{id}/revisions/view/{left}/{right}/split_fields`. In these Diff versions, the route and the controller check only `view` access on the item and on each revision. So the user can compare any two unpublished revisions of the item, including older drafts. Revision IDs are sequential numbers. With Diff 2.0.1, 2.1.1, or later, the user also needs **View all AI Context Item revisions**. * The AI Agents module (`ai_agents`) is a required dependency of this module. An AI agent that the user can run and that has the AI Agents tools **List Content Entities** or **Get Current Content Entity Values** can list and read draft and archived items. These tools check only `view` access. Context items have no query access handler, so the list tool does not need the item IDs. * Other code that checks `view` access on a context item, for example `$item->access('view')`, gets the same result. Core gives this grant to every publishable entity type, for example media. For context items, it conflicts with the documented access model. `docs/developers/access-boundaries.md` and `docs/developers/configuration.md` say that unpublished items need **View any unpublished AI Context Item**, or ownership plus **View AI Context Items in CCC**. The handler already returns forbidden for `update` and `delete` when no rule allows them. Only `view` returns neutral. ### Security impact * **Who:** any role with core's **View any unpublished content**. The user does not need an AI Context permission. Core does not mark **View any unpublished content** or **View the latest version** as "restrict access". On a Drupal CMS site, the Content editor role has **View any unpublished content** (from the `drupal_cms_content_type_base` recipe), but not **View the latest version**. A role that also has **View AI Context Items in CCC** can open the drafts of other users. Without the core permission, users with that role can open only their own drafts. * **What:** read-only access to draft and archived context items: the title, Description, Purpose, Content, and other fields. Drafts can contain internal instructions and policies that are not ready to publish. The user cannot edit or delete items. A user with only the core permission cannot list items in the CCC user interface, because the listing needs **View AI Context Items in CCC**. That user must open the item URL directly. Item IDs are sequential numbers. A user who also has **View AI Context Items in CCC** sees the draft and archived items of other users in the CCC listing, `/admin/config/ai/context/items`, with their label, Purpose, scopes, and status. An AI agent with the AI Agents entity tools can list the items. * **Not affected:** this module's selection and context function calls. They use only published items. * **Versions:** 1.0.0-beta1 to 1.0.0-rc1, and 1.0.x. No stable release exists yet, so this bug is handled in public, as in #3586615+s. Related: #3586703+s adds the revision permission to the Diff compare route. This issue does not change that route. ## Steps to reproduce 1. Create a role with only **View any unpublished content** and **View the latest version**. Create a user with that role. 2. As an administrator, create a context item and save it as a draft. 3. As the new user, open `/admin/config/ai/context/items/{id}` for that item. The page shows the draft. Expected: "Access denied". 4. As an administrator, publish a context item, then save a new draft of it. 5. As the new user, open `/admin/config/ai/context/items/{id}/latest` for that item. The page shows the pending draft. Expected: "Access denied". Confirmed on `1.0.x` at `65f20b72`. ## Proposed resolution In `AiContextItemAccessControlHandler::checkAccess()`, for `view` of an unpublished item, return forbidden unless one of these rules allows it: * **Administer AI Context** * **View any unpublished AI Context Item** * **View AI Context Items in CCC**, and the user owns the item Keep the cache metadata: per permissions, per user when ownership decides the result, and the item as a cacheable dependency. A forbidden result cannot be changed by other access hooks. So the Content Moderation grant no longer applies to unpublished context items. This change applies to every check of `view` access on an unpublished item: the item page, the CCC listing, the **Latest version** tab, the revision history and revision pages, the Diff compare page, the context item labels and links on usage records, the AI Agents entity tools, and custom code. This issue does not change any route. Published items do not change. They still return neutral when no rule allows them. Content Moderation does not grant `view` of published items, and a change there has a larger effect on other modules. The **Latest version** tab still needs core's **View the latest version** and **View any unpublished content** (or **View own unpublished content** for the owner), because core's `LatestRevisionCheck` checks them. With this change, the tab also needs view access to the context item. The revision history and revision pages still need **View all AI Context Item revisions**. They also need view access to the item and to each revision that the user opens. Docs: * `docs/developers/access-boundaries.md` ("Context item view access"): the deny is final, core's **View any unpublished content** gives no access, and the revision history and revision pages need the revision permission and view access to each revision. * `docs/developers/configuration.md`: core Content Moderation permissions do not give view access to unpublished context items. What the **Latest version** tab needs. * `docs/developers/api-stability.md`: new section "Upgrade from 1.0.0-rc1: context item view access" (access hooks, core permissions, roles that need drafts, published items). ## Remaining tasks * [x] Return forbidden for `view` of unpublished items in `AiContextItemAccessControlHandler::checkAccess()`. * [x] Kernel test: `AiContextItemModerationAccessTest::testCoreUnpublishedPermissionDoesNotGrantView`. It also covers a non-owner with **View AI Context Items in CCC**. It fails without the fix. * [x] Kernel test: `AiContextItemModerationAccessTest::testLatestVersionRouteNeedsContextItemViewAccess`. It fails without the fix. * [x] Kernel test: `AiContextItemModerationAccessTest::testRevisionRoutesNeedContextItemViewAccess`: the revision history and revision routes of a draft item, and the published and pending draft revisions of a published item. * [x] Kernel test: `AiContextItemAccessControlHandlerCacheTest::testNonOwnerViewingUnpublishedItemIsForbiddenWithUserCacheContext` expects forbidden, not neutral, for a non-owner. * [x] Kernel test: `AiContextItemAccessControlHandlerCacheTest::testConsumerViewingUnpublishedItemIsForbiddenPerPermissions`: forbidden for a user with only **Use Published AI Context in AI Features**, per permissions, not per user, with the item cache tag. * [x] Docs: `docs/developers/access-boundaries.md`, `docs/developers/configuration.md`, and `docs/developers/api-stability.md`. * [x] Check on a local site with HTTP requests through drush: a user with only the two core permissions gets 403 on a draft item page and on the **Latest version** tab. An administrator gets 200 on both pages. * [ ] Check in a browser as a user with only the two core permissions: "Access denied" on a draft item page, on the **Latest version** tab, and, with Diff 8.x-1.x installed, on the revision compare page of a draft item. With **View all AI Context Item revisions** also: "Access denied" on the revision history of a draft item. With **View AI Context Items in CCC** also: the draft item of another user is not in the CCC listing. * [ ] Review. ## User interface changes None. A user who has only core Content Moderation permissions now gets "Access denied" on unpublished context items and on the **Latest version** tab. A user who also has **View all AI Context Item revisions** now gets "Access denied" on the revision pages of unpublished items. A user who also has **View AI Context Items in CCC** no longer sees the draft and archived items of other users in the CCC listing. ## API changes `view` access for an unpublished context item is now forbidden, not neutral, when no context item rule allows it. A `hook_entity_access()` or `hook_ai_context_item_access()` implementation can no longer allow `view` of unpublished context items for such users. Published items do not change. `docs/developers/api-stability.md` documents this in "Upgrade from 1.0.0-rc1: context item view access". ## Data model changes None. ## Release note Fixes a bug with a security impact. Core's **View any unpublished content** and **View the latest version** permissions no longer give access to unpublished context items. This applies to the item page, the CCC listing, the **Latest version** tab, and the revision pages. Before this fix, a role with **View any unpublished content**, for example the Content editor role on Drupal CMS, could read draft and archived context items without an AI Context permission. Sites that used these core permissions so that editors can see context drafts must give those roles **View any unpublished AI Context Item**. Custom access hooks can no longer allow view of unpublished context items. Run `drush cr` after the update. > [!note] > Check the one that best describes your usage, or leave all unchecked if AI was not significantly used. > > * [ ] AI **Assisted Issue** \ > _Mainly written by a human; AI used for partial generation under full human supervision._ > > * [x] AI **Generated Issue** \ > _Mainly generated by AI, reviewed and approved by a human before this issue was created._