fix: #3621487 Require node update access on the Canvas Override and Reset layout routes

Rajab Natshahrequested to merge
issue/canvas_override-3621487:3621487-require-node-update-access into 1.0.x

Issue: https://www.drupal.org/project/canvas_override/issues/3621487

Summary

CanvasTabAccessCheck and CanvasResetAccessCheck granted access on Canvas Override permissions alone, so a user with only reset canvas layout (not restrict-access) could open the per-content editor or wipe the stored layout of any node of an enabled type, including content they cannot edit or view.

Both access checks now andIf() the node's own update access, with entity access cacheability merged into the result.

AI-Generated: Yes (fix authored with Claude Code; reviewed by Rajab Natshah.)

Checkpoints

  • File an issue about this project
  • Addition/Change/Update/Fix to this project
  • Testing to ensure no regression
  • Automated unit/functional testing coverage
  • Developer Documentation support on feature change/addition
  • User Guide Documentation support on feature change/addition
  • UX/UI designer responsibilities
  • Accessibility and Readability
  • Reviewed by a human
  • Code review by maintainers
  • Full testing and approval
  • Credit contributors
  • Review with the product owner
  • Update Release Notes
  • Release
Edited by Rajab Natshah

Merge request reports