Entity reference widgets: preserve hidden OG groups on save and stop leaking labels in autocomplete widget load
>>> [!note] Migrated issue
<!-- Drupal.org comment -->
<!-- Migrated from issue #3554116. -->
Reported by: [joelpittet](https://www.drupal.org/user/160302)
Related to !55
>>>
<h3 id="summary-problem-motivation">Problem/Motivation</h3>
<p>
A kernel test confirms group content saves should preserve references to groups<br>
the current editor cannot see (no membership / no create access). In the actual<br>
edit form, certain core entity reference widgets can still drop those hidden<br>
references on submit (data loss) or hit validation paths that remove them.<br>
Additionally, the <em>autocomplete</em> widgets leak private group <em>labels on initial form load</em><br>
and will cause a validation error to the user on save (as expected when the private group is referenced).<br>
The autocomplete <em>search callback itself is correctly filtered</em> by the selection handler and does not<br>
return private groups.
</p>
<h4 id="summary-steps-reproduce">Steps to reproduce</h4>
<ol>
<li>Set up OG with one group type and one group-content type using the audience field<br>
(<code>OgGroupAudienceHelperInterface::DEFAULT_FIELD</code>) targeting node groups.</li>
<li>Create three groups: G1, G2, <strong>G3 (private)</strong>.</li>
<li>As an administrator, create group content that references <strong>all three</strong> groups.</li>
<li>Create a <strong>two-group editor</strong> (member with create/edit-own in G1 and G2 only; no access to G3).</li>
<li>Edit the content as the two-group editor. Test each core widget:
<ol>
<li>Options: Select list (<code>options_select</code>)</li>
<li>Options: Check boxes / Radios (<code>options_buttons</code>)</li>
<li>Entity reference Autocomplete (<code>entity_reference_autocomplete</code>)</li>
<li>Entity reference Autocomplete (Tags) (<code>entity_reference_autocomplete_tags</code>)</li>
</ol>
</li>
<li>Save the form without changing the audience field.</li>
<li>For autocomplete widgets, note that on initial load, a value for <strong>G3 (private)</strong> is rendered.<br>
Start typing G3’s label in the field: <em>no suggestion appears</em> (callback is filtered).</li>
</ol>
<p><strong>Observed:</strong> (a) Some widgets drop <strong>G3 (private)</strong> on save or via validation;<br>
(b) autocomplete widgets reveal the label of <strong>G3 (private)</strong> on initial form load. <br><br>
<strong>Expected:</strong> (a) All original references (G1, G2, G3) persist on save; (b) private groups are not<br>
displayed or revealed to users without access—neither in initial widget values nor in suggestions.</p>
<h3 id="summary-proposed-resolution">Proposed resolution</h3>
<ul>
<li><strong>Add functional tests</strong> that reproduce and guard against these behaviors across the four core widgets:
<ul>
<li>Arrange: admin creates content referencing G1, G2, G3; the <strong>two-group editor</strong> has access to G1 & G2 only.</li>
<li>Assert per widget:
<ul>
<li><strong>G3 (private)</strong> is not visible/selectable to the two-group editor in the UI.</li>
<li>Submitting without changing the field returns <code>SAVED_UPDATED</code> and the entity still references all three groups (no data loss).</li>
<li>For autocomplete widgets: initial load does <em>not</em> expose the private group label; search suggestions remain correctly filtered (no G3).</li>
</ul>
</li>
<li>Use <code>BrowserTestBase</code> for all tests as we won't test the AJAX functionality.</li>
</ul>
</li>
<li><strong>Fix autocomplete label leak on load</strong> (values rendering):
<ul>
<li>When rendering default values, avoid resolving/displaying labels for referenced entities the current user cannot access.</li>
<li>Ensure hidden private groups cannot be removed accidentally by the user via the UI.</li>
</ul>
</li>
<li><strong>Fix data loss across all four widgets</strong>:
<ul>
<li>On submit, merge submitted values with the entity’s original audience references so that unseen/hidden IDs are preserved.</li>
<li>Adjust widget input processing/validation so existing references the user cannot see are allowed and retained (they were already present).</li>
<li>Aim to implement this within widget element processing (e.g., <code>formElement()</code>, <code>massageFormValues()</code>) rather than silently discarding unseen IDs.</li>
</ul>
</li>
</ul>
<h3 id="summary-ui-changes">User interface changes</h3>
<ul>
<li>Autocomplete widgets no longer show private group labels in their loaded values, yet all private groups will continue to persist after save.</li>
</ul>
issue