<h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>A user who can translate context items, but cannot edit them, can change the shared settings of an item from the translation form: the scopes (Roles, Global, Context Tags and the other scopes), Priority, Specific Entities, <strong>Same as parent</strong>, <strong>Parent context</strong> and <strong>Subcontext type</strong>. These fields are not translatable, so the change applies to all languages. The user can also publish the change. For example, the user can remove a Roles restriction, so that a restricted item goes to all users.</p> <p>Core <code>ContentTranslationHandler::entityFormSharedElements()</code> hides the shared fields on the translation form, but it skips <code>details</code> elements. CCC puts the scope controls, Priority, Specific Entities and <strong>Same as parent</strong> in the <code>context_scope</code> details element, so core does not hide them. The core setting "Hide non translatable fields on translation forms" does not help. <strong>Parent context</strong> and <strong>Subcontext type</strong> are outside that element, so core hides them only when that setting is on. Without it, a translator can move a child item that uses <strong>Same as parent</strong> under a less restricted parent, which changes the scopes of the child for all languages.</p> <p>This is the same type of problem as the Duplicate fix in #3586706+s: a user can avoid the editorial access rules. It is the same in 1.0.0-rc1. The 1.0.0-rc2 smoke test found it.</p> <h3 id="summary-steps-reproduce">Steps to reproduce</h3> <ol> <li>Enable Content Translation for context items and add a second language, for example Afrikaans.</li> <li>Create a role with these permissions: <strong>Translate AI Context Item</strong>, <strong>Create translations</strong>, <strong>Edit translations</strong>, <strong>View AI Context Items</strong>, <strong>Use Published AI Context in AI Features</strong> and the Create new draft and Publish transitions. Do not give an edit permission for context items.</li> <li>As an admin, create a published item with a Roles scope, and translate it.</li> <li>As the translator, open the translation edit form, for example <code>/af/admin/config/ai/context/items/[id]/translations/edit/af</code>.</li> <li>Clear the Roles checkbox and save.</li> </ol> <p>Expected: the scope controls are not on the form, or the stored scopes do not change.<br> Actual: the save works, and the Roles scope is removed for all languages.</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <ul> <li>In <code>AiContextItemForm</code>, set <code>#access</code> to FALSE on <code>context_scope</code> (with <code>priority</code>, <code>entity_items</code> and <code>inherit_parent_scope</code> inside it), <code>parent</code> and <code>subcontext_type</code> on a translation form, and on a non-default translation when <code>isDefaultTranslationAffectedOnly()</code> is TRUE. Show the core message with the link to the original language form.</li> <li>On save, also keep the stored values of these fields for these forms, so that a changed POST cannot change them.</li> <li>Add a functional test for the translator role, also with a changed POST for <code>parent</code>, and a test for a user who can edit, so that the original language form still works.</li> <li>Update <code>docs/features/multilingual.md</code>.</li> </ul> <h3 id="summary-implementation-notes">Implementation notes</h3> <ul> <li>Branch from <code>1.0.x</code>. The fix goes into 1.0.0.</li> <li>Use the same check as core for a translation form: <code>$form_state-&gt;get(['content_translation', 'translation_form'])</code> (see <code>ContentTranslationHandler::entityFormSharedElements()</code>). For the other case, use <code>isDefaultTranslationAffectedOnly() &amp;&amp; !isDefaultTranslation()</code>.</li> <li><code>AiContextItemForm::form()</code> builds <code>context_scope</code> and <code>subcontext_settings</code>. When <code>parent</code> and <code>subcontext_type</code> are hidden, also hide the empty <code>subcontext_settings</code> details.</li> <li>Reuse the core message: "Fields that apply to all languages are hidden to avoid conflicting changes. Edit them on the original language form.", with the link to the original language edit form.</li> <li>In <code>AiContextItemForm::buildEntity()</code>, copy the stored values of <code>scope</code>, <code>priority</code>, <code>entity_items</code>, <code>inherit_parent_scope</code>, <code>parent</code> and <code>subcontext_type</code> back to the entity for these forms.</li> <li>Tests: extend <code>tests/src/Functional/AiContextItemTranslationUITest.php</code>. It already has <code>testNonTranslatableFieldsShared()</code>.</li> </ul> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <ul> <li>Fix, test and review.</li> <li>Add this bug as a known issue to the 1.0.0-rc2 release notes on drupal.org.</li> <li>If the fix is not in 1.0.0, also list it as a known issue in the 1.0.0 release notes.</li> </ul> <h3 id="summary-ui-changes">User interface changes</h3> <p>The translation form no longer shows the scope, Priority, Specific Entities, <strong>Same as parent</strong>, <strong>Parent context</strong> and <strong>Subcontext type</strong> controls.</p> <h3 id="summary-api-changes">API changes</h3> <p>None.</p> <h3 id="summary-data-model-changes">Data model changes</h3> <p>None.</p>