>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3591388. --> Reported by: [pwolanin](https://www.drupal.org/user/49851) Related to !6 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p> EntityAccessService::alterQueryForType() currently bubbles a coarse ['user'] cache context (see the @todo in that method). The user context partitions cache by uid only, which is wrong when a grant provider computes grants from per-request state (active OG context, query params, time-based windows, etc.): the same user can legitimately have different effective grants across requests, but the user context can't see that and serves stale output.</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p> Add a calculated cache context user.entity_access_grants:{entity_type_id}:{op} whose key is a hash of acquireGrants($current_user, $op). The hash is self-invalidating: if a user's grants change for any reason &mdash; OG membership change, role permission change, time-of-day window, etc. &mdash; they land on a new cache key automatically, with no tag invalidation needed. Conversely, two requests producing the same grants legitimately share the entry, whether for the same user or different users.</p> <p>Wire the new context name into EntityAccessService and drop the @todo.</p> <p>NOTE: this is a correctness fix for the "same user, different grants across requests" case.</p> <p>This is not a guaranteed cache-sharing optimization. If any grant carries a per-user gid (e.g., a {realm: 'owner', gid: $uid} "view own" grant), the hash includes that uid and the cache cardinality is one entry per user &mdash; same as ['user']. Cross-user sharing only happens when grant providers only express access via shared identifiers (roles, groups). Node module has the same property with user.node_grants:view.</p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <p>Files to add/update:</p> <table> <thead> <tr> <th>File</th> <th>Change</th> </tr> </thead> <tbody> <tr> <td><code>src/Cache/EntityAccessGrantsCacheContext.php</code></td> <td>New &mdash; calculated cache context class.</td> </tr> <tr> <td><code>raft_entity_access.services.yml</code></td> <td>Register the cache context with <code>cache.context</code> tag (autowire).</td> </tr> <tr> <td><code>src/EntityAccessService.php</code></td> <td>Replace the <code>['user']</code> placeholder; drop the <code>@todo</code>.</td> </tr> <tr> <td><code>src/EntityAccessService.php</code> (<code>rebuild</code>)</td> <td>Invalidate <code>raft_entity_access:records:{type}</code> to drop stale listings after a bulk rebuild.</td> </tr> <tr> <td><code>README.md</code></td> <td>Brief section on the cache context and the per-user cardinality caveat.</td> </tr> </tbody> </table> <h3 id="summary-ui-changes">User interface changes</h3> <p>n/a</p> <h3 id="summary-api-changes">API changes</h3> <p> Additive. No new hooks. No changes to grant providers required.</p> <h3 id="summary-data-model-changes">Data model changes</h3> <p>n/a</p> <h3> Considered alternatives</h3> <p> - ['user'] (today). Doesn't handle stateful grants. Correctness gap.<br> - max-age=0 baseline. Correct, but disables render cache for affected entity types and merges as min, so providers can't relax it. Slow.<br> - Per-entity-type context services registered via ServiceProviderInterface. Matches a naming like user.rocket_ship_entity_grants:view, but the entity-type registry isn't<br> reliably available at container compile time. Brittle.</p>