Editor can't set unpublished Service Landing Page as parent of Service Page

[keelanfh]

Steps to replicate

• Fresh LGD install with localgov_demo
• Log in as an Editor
• Create a Service Landing Page and save it without publishing
• Create a Service Page
• Attempt to set the Service Landing Page as the Parent of the Service Page

Expected behaviour

• The unpublished Service Landing Page appears as an option in the autocomplete and can be set as the Parent

Observed behaviour

• The unpublished Service Landing Page does not appear in the autocomplete

Note: this works as expected when logged in as an Admin. It is only when logged in as Editor that I can see this issue.

[willguv]

@andybroomfield does your patch fix this issue? Thanks

[andybroomfield]

Don't know if its the patch or not, as it's an unrelated issue. We never encouterd it at BHCC as we had bypass node access enabled for editors for a while, and we disabled it but replaced it with view_unpublished which raised the issue mentioned. I think it's required that the editors can view the unpublished page before they can reference it, so you'll need to check editor permissions.

[andybroomfield]

I think that this is code that locks it to published nodes unless user has access

localgov_services/modules/localgov_services_navigation/src/Plugin/EntityReferenceSelection/ServicesSelection.php

Lines 236 to 243 in 09b9003

	// Adding the 'node_access' tag is sadly insufficient for nodes: core
	// requires us to also know about the concept of 'published' and
	// 'unpublished'. We need to do that as long as there are no access control
	// modules in use on the site. As long as one access control module is
	// there, it is supposed to handle this check.
	if (!$this->currentUser->hasPermission('bypass node access') && !$this->moduleHandler->hasImplementations('node_grants')) {
	$query->condition('status', NodeInterface::PUBLISHED);
	}

[markconroy]

I think it's required that the editors can view the unpublished page before they can reference it, so you'll need to check editor permissions.

Maybe we should update the editor permissions in that case.

[markconroy]

I'm back - looks like 'Editor' has permission "View all unpublished content" already, but this is not enough to let them use an unpublished service landing page as a parent of a service page.

If I delete

if (!$this->currentUser->hasPermission('bypass node access') && !$this->moduleHandler->hasImplementations('node_grants')) {
      $query->condition('status', NodeInterface::PUBLISHED);
    }

from ServicesSelection.php, I can set unpublished nodes as parents. So ... it looks like we need to do a bit of work (if we agree Editors should be allowed to do this) or else grant editors the bigger permission of "Bypass node access".