fix: #3621557 Fail safely with a 403 instead of a 500 when Canvas cannot edit an entity

Rajab Natshahrequested to merge
issue/canvas_override-3621557:3621557-graceful-403-unpatched into 1.0.x

Issue: https://www.drupal.org/project/canvas_override/issues/3621557

Summary

Investigated running Canvas Override without the Canvas patch (#3567225). Finding: a fully working per-content editor without the patch is not achievable module-side — ComponentTreeLoader is a final class and six Canvas consumers type-hint the concrete class, so any stand-in either TypeErrors on Canvas's hot path or cannot change behaviour; backing-canvas_page (reverted in #3620603) and controller-forks were evaluated and rejected. The durable fix is upstream (#3567225, ideally plus extracting a ComponentTreeLoaderInterface).

This MR ships the one safe improvement available without forking Canvas: on unpatched Canvas, a bundle enabled via config import still resolves its Canvas/editor links, and Canvas's ComponentTreeEditAccessCheck throws a LogicException — an uncaught exception in an access check surfaces as an HTTP 500. This MR retargets that access check (consumed only through the access_check tag, so nothing type-hints the concrete class) to a module check that composes Canvas's final check (its constructor is public) and converts the LogicException into a cacheable 403 with an explanation.

  • Zero forked Canvas code.
  • Byte-identical behaviour for canvas_page and any other entity type Canvas supports.
  • Verified on a fresh Drupal CMS 2.1 install (Drupal 11.4.6, unpatched Canvas): the upstream check throws (500); the module check returns a forbidden access result and the API returns a 403.

AI-Generated: Yes (investigated and authored with Claude Code; reviewed by Rajab Natshah.)

Checkpoints

  • File an issue about this project
  • Addition/Change/Update/Fix to this project
  • Testing to ensure no regression
  • Automated unit/functional testing coverage
  • Developer Documentation support on feature change/addition
  • User Guide Documentation support on feature change/addition
  • UX/UI designer responsibilities
  • Accessibility and Readability
  • Reviewed by a human
  • Code review by maintainers
  • Full testing and approval
  • Credit contributors
  • Review with the product owner
  • Update Release Notes
  • Release

Merge request reports