>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3581254. --> Reported by: [attilatilman](https://www.drupal.org/user/3528404) Related to !801 >>> <p>Opening the code editor (<code>/canvas/code-editor/component/*</code>) crashes with a fatal error boundary if the current user does not have the "administer brand kit" permission.</p> <h3>Steps to reproduce</h3> <ol> <li>Create a user role without the "administer brand kit" permission.</li> <li>Try to create a new component.</li> <li>The code editor crashes instead of loading.</li> </ol> <h3>Expected behavior</h3> <p>The code editor loads normally. Users without the brand kit permission should simply not see the brand kit sidebar panel, which is already correctly gated.</p> <h3>Actual behavior</h3> <p><code>useGetCodeEditorData</code> fetches <code>brand_kit/global</code> unconditionally on every code editor load. When the API returns 403, <code>errorGetBrandKit</code> is set and <code>showBoundary()</code> is called, crashing the entire code editor.</p> <h3>Root cause</h3> <p>In <code>useGetCodeEditorData.ts</code>:</p> <ul> <li>Around line 147&ndash;165: <code>useGetAutoSaveQueryBrandKit</code> is called with no permission guard &mdash; the brand kit API is always fetched regardless of whether the user has the <code>brandKit</code> permission.</li> <li>Around line 199: <code>isSuccess</code> requires the brand kit fetch to succeed, blocking the editor from initializing.</li> <li>Around line 220&ndash;222: Any brand kit error is passed to <code>showBoundary()</code>, making it a fatal crash.</li> </ul> <p>The brand kit sidebar panel is correctly gated (<code>!hasPermission('brandKit') || !devMode</code>), but the underlying data fetch is not.</p> <h3>Proposed fix</h3> <p>Skip the brand kit fetch from auto-save when the user lacks the <code>brandKit</code> permission (mirror the existing panel permission gate)</p> > Related issue: [Issue #3577631](https://www.drupal.org/node/3577631)