Issue #3612253 by gbathree: allow users to reference their own quantities in access-checked queries

--> AI generate content, reviewed by Greg -->

Fixes the quantity_access query alter so non-admin users can save quantity-bearing quick forms.

farm_multitenant_query_quantity_access_alter() only allowed quantities reachable via log__quantity → log → asset → the user's farms. A quick-form-created quantity has no log__quantity row while its log is being validated, so the log's ValidReference constraint rejected it and the submission rolled back — for every non-admin user, regardless of granular quantity permissions.

This MR ORs an own-quantity exemption (quantity.uid = current user) into the existing condition group. A quantity no log references is only meaningful to its creator, so this closes the validation gap without exposing other farms' data. Members' access via the log→asset→farm chain is unchanged; anonymous users without memberships still get deny-all.

One deliberate policy point for review: the exemption is unconditional on ownership — own quantities stay query-visible to their creator even after a log links them to a farm the user has since left, diverging from the purely membership-based asset/log alters. Own-authored data seemed the right line to draw (and the surrounding log/asset context stays membership-scoped), but flagging it so it's a conscious choice; a stricter no-log__quantity-row-only exemption would also fix the bug if you prefer membership purity.

Includes a kernel test (QuantityQueryAccessTest) proving: own not-yet-referenced quantity passes access-checked entity queries + ValidReference-style selection; cross-farm and other-user unreferenced quantities stay filtered; anonymous gets nothing.

Closes #3612253

Merge request reports

Loading
Loading