> No stable release exists yet, so this is a public issue, as with #3586615+s. ## Summary When the Diff module is installed, `DiffHooks::entityTypeAlter()` (`src/Hook/DiffHooks.php`) uses Diff's `DiffRouteProvider` for context items. Users can then compare two revisions of an item. In Diff 8.x-1.x, 2.0.0, and 2.1.0, the route `entity.ai_context_item.revisions_diff` needs only `_entity_access: ai_context_item.view`. Diff's controller then checks only `view` access on each of the two revisions. The revision routes of this module in `ai_context.routing.yml` need **View all AI Context Item revisions**. `AiContextRouteSubscriber::alterRoutes()` does not change the Diff route. * **Who:** any user with **Use Published AI Context in AI Features**. This permission does not have `restrict access: true`. `docs/developers/consumer_api.md` tells how to give it to the Anonymous role for a public chatbot. On such a site, anonymous visitors can open the Diff pages. * **What they get:** all fields that Diff shows, for every older published revision of every published item. Older revisions can contain text that editors removed on purpose. Draft revisions stay hidden, because Diff checks `view` access on each revision. * **Versions:** ai_context 1.0.0-beta1 to 1.0.0-rc1 and 1.0.x-dev, on sites with Diff 8.x-1.x, 2.0.0, or 2.1.0. Diff 2.0.1 and 2.1.1 changed the route requirement to `view all revisions`, so sites on those Diff versions do not have this bug. The `require-dev` of this module pins `drupal/diff: ^1.0`, so the tests run on Diff 8.x-1.x. Diff also adds no cache metadata for its access checks on each revision. Three related problems move to #3586704+s, a public issue for 1.0.1, because after this fix they need restricted permissions: Specific Entities labels in Diff output, a draft translation on the revision page, and Context Tags and Taxonomy Terms names in Diff output (found by @Pravesh_Poonia). Related: #3586675+s (row 7: mark **Use Published AI Context in AI Features** as restricted). ## Steps to reproduce The code on `1.0.x` at `65f20b72` still has this bug. A kernel test on `1.0.x` with Diff 8.x-1.10 confirms it. On a site with Diff 8.x-1.x, 2.0.0, or 2.1.0: 1. Install Diff. Create a context item with the content "A" and publish it. Edit it, change the content to "B", and publish it again. 2. Create a user whose only AI Context permission is **Use Published AI Context in AI Features**. 3. As that user, open `/admin/config/ai/context/items/{id}/revisions/view/{first revision ID}/{second revision ID}/split_fields`. The page shows both revisions, with "A" and "B". 4. As the same user, open `/admin/config/ai/context/items/{id}/revisions/{first revision ID}/view`. The page returns 403. This is correct. ## Proposed resolution 1. In `AiContextRouteSubscriber::alterRoutes()`, give `entity.ai_context_item.revisions_diff` the requirement `_entity_access: 'ai_context_item.view all revisions'`. This is the requirement of the revision history route, and of Diff 2.0.1 and 2.1.1. On those Diff versions, the requirement change has no effect. Also set the `no_cache` route option, because Diff adds no cache metadata for its access checks on each revision. The `no_cache` option also applies on Diff 2.0.1 and 2.1.1, because upstream Diff does not set it. 2. Add the kernel test `AiContextItemRevisionDiffAccessTest`. Keep `require-dev` on `drupal/diff: ^1.0`, so that the test runs on a Diff version without the upstream change. 3. Docs: a new section "Revision and Diff pages" in `docs/developers/access-boundaries.md`, the two permission tables and the editor role text in `docs/developers/configuration.md`, and the Diff integration section in `docs/features/revisions.md`. Name Diff 2.0.1 and 2.1.1 as the versions with the upstream change. ## Remaining tasks * [x] Diff route requirement and `no_cache`. * [x] Kernel test: `AiContextItemRevisionDiffAccessTest::testDiffRouteNeedsRevisionPermission`. It fails on `1.0.x` with Diff 8.x-1.x. * [x] Docs for the Diff route. * [x] Docs: name Diff 2.0.1 and 2.1.1 as the versions with the upstream change. * [x] Rebase on `1.0.x`. Resolve the conflict in `docs/features/revisions.md`. * [ ] Browser check with Diff 8.x-1.x: the Diff page returns 403 for a user with only **Use Published AI Context in AI Features**, and shows the comparison for a user with **View all AI Context Item revisions** and view access to the item. * [ ] Review. ## User interface changes * Users without **View all AI Context Item revisions** get 403 on the Diff pages. ## API changes * The route `entity.ai_context_item.revisions_diff` needs `ai_context_item.view all revisions` access and has the `no_cache` option. ## Data model changes None. ## Release note Diff pages for context items now need the **View all AI Context Item revisions** permission, as the revision history page does. Before, on sites with Diff 8.x-1.x, 2.0.0, or 2.1.0, any user with **Use Published AI Context in AI Features** could compare older published revisions. Review which roles have **View all AI Context Item revisions**. After the update, rebuild the caches (`drush cr`), so that the router uses the new requirement. > [!note] > Check the one that best describes your usage, or leave all unchecked if AI was not significantly used. > > * [ ] AI **Assisted Issue** \ > _Mainly written by a human; AI used for partial generation under full human supervision._ > > * [x] AI **Generated Issue** \ > _Mainly generated by AI, reviewed and approved by a human before this issue was created._