Issue #3040181 by paulocs, quietone, snehalgaikwad, ravi.shankar, acbramley,...

Issue #3040181 by paulocs, quietone, snehalgaikwad, ravi.shankar, acbramley, alexpott, mindbet, ultrabob, bthompson1, Lendude, lapaev, pameeela, catch: Unpublished books appear in the list of books at /book

core/modules/book/src/BookManager.php

@@ -114,7 +114,7 @@ protected function loadBooks() {
       // @todo: use route name for links, not system path.
       foreach ($book_links as $link) {
         $nid = $link['nid'];
-        if (isset($nodes[$nid]) && $nodes[$nid]->status) {
+        if (isset($nodes[$nid]) && $nodes[$nid]->access('view')) {
           $link['url'] = $nodes[$nid]->toUrl();
           $link['title'] = $nodes[$nid]->label();
           $link['type'] = $nodes[$nid]->bundle();

core/modules/book/tests/src/Functional/BookTest.php

@@ -22,6 +22,7 @@ class BookTest extends BrowserTestBase {
    * @var array
    */
   protected static $modules = [
+    'content_moderation',
     'book',
     'block',
     'node_access_test',
@@ -71,6 +72,7 @@ protected function setUp(): void {
       'create book content',
       'edit own book content',
       'add content to books',
+      'view own unpublished content',
     ]);
     $this->webUser = $this->drupalCreateUser([
       'access printer-friendly version',
@@ -91,6 +93,7 @@ protected function setUp(): void {
       'node test view',
       'administer content types',
       'administer site configuration',
+      'view any unpublished content',
     ]);
   }
 
@@ -501,16 +504,54 @@ public function testSaveBookLink() {
    * Tests the listing of all books.
    */
   public function testBookListing() {
-    // Create a new book.
-    $this->createBook();
+    // Uninstall 'node_access_test' as this interferes with the test.
+    \Drupal::service('module_installer')->uninstall(['node_access_test']);
 
-    // Must be a user with 'node test view' permission since node_access_test is installed.
-    $this->drupalLogin($this->webUser);
+    // Create a new book.
+    $nodes = $this->createBook();
 
     // Load the book page and assert the created book title is displayed.
     $this->drupalGet('book');
 
     $this->assertText($this->book->label(), 'The book title is displayed on the book listing page.');
+
+    // Unpublish the top book page and confirm that the created book title is
+    // not displayed for anonymous.
+    $this->book->setUnpublished();
+    $this->book->save();
+
+    $this->drupalGet('book');
+    $this->assertSession()->pageTextNotContains($this->book->label());
+
+    // Publish the top book page and unpublish a page in the book and confirm
+    // that the created book title is displayed for anonymous.
+    $this->book->setPublished();
+    $this->book->save();
+    $nodes[0]->setUnpublished();
+    $nodes[0]->save();
+
+    $this->drupalGet('book');
+    $this->assertSession()->pageTextContains($this->book->label());
+
+    // Unpublish the top book page and confirm that the created book title is
+    // displayed for user which has 'view own unpublished content' permission.
+    $this->drupalLogin($this->bookAuthor);
+    $this->book->setUnpublished();
+    $this->book->save();
+
+    $this->drupalGet('book');
+    $this->assertSession()->pageTextContains($this->book->label());
+
+    // Ensure the user doesn't see the book if they don't own it.
+    $this->book->setOwner($this->webUser)->save();
+    $this->drupalGet('book');
+    $this->assertSession()->pageTextNotContains($this->book->label());
+
+    // Confirm that the created book title is displayed for user which has
+    // 'view any unpublished content' permission.
+    $this->drupalLogin($this->adminUser);
+    $this->drupalGet('book');
+    $this->assertSession()->pageTextContains($this->book->label());
   }
 
   /**