Add: "View any unpublished [entity_type]" permission

so that we fetch both published and unpublished product when the current user has the view any unpublished product permission.

Yes, I agreed w/ @Berdir that the query conditions could be optimized based on earlier logic checks.

if ($has_owner && $account->hasPermission("view any unpublished $entity_type_id")) {

If the user has the view any permisison, why do we care about $has_owner? This seems like a candidate for if/elseif/else

if ($account->hasPermission("view any unpublished $entity_type_id")) {

} elseif ($has_owner && $account->hasPermission("view own unpublished $entity_type_id") {

} else { 
  // published logic
}

Opened the issue fork and added a commit based on #27, implementing some of the optimization mglaman suggested in #39.

Leaving in "needs work" because I feel it can be optimized further.

Also we might want to add "view any unpubliched $bundle $type" permissions as well.

Created patch from the MR

Hi! Could someone from the maintainers review the latest patch and leave feedback what's need to be done else e.g. https://www.drupal.org/project/entity/issues/3023527#comment-15157931 ✨ Add: "View any unpublished [entity_type]" permission Needs work or it can be merged as is? Thanks!

#42 ✨ Add: "View any unpublished [entity_type]" permission Needs work works as expected

core: 10.2.3
entity: 8.x-1.4

Hi
I am also tested, and #42 wroks!

The patch from #42 works fine.

update patch to changes in 1.5 version

Nice patch! #47 worked over here.
Thanks community ☺️

It doesn't work on core 10.2.7. Any help pls?

re-roll #47

nicxvan → changed the visibility of the branch 8.x-1.x to hidden.

nicxvan → changed the visibility of the branch 3023527-add-view-any to hidden.

I'm going to see if I can refresh this and take a look if the feedback has been addressed.

I'm hiding the patches so we can make sure the work stays in the same MR the patches seem to have diverged from the MR so I created a new one starting with patch in 50.

Ok I hope it is ok to still mark this, I only updated test variables to the ones they were clearly meant to be.

I went through it and it looks right.

I manually tested it too.
The cache contexts look like they were updated properly
I did change the variables in the test because they were named wrong.

Tests pass and the test only job fails.

The patch looks good at first glance, haven't manually tested it, but just noting that I'd like Commerce to leverage the change for its Product entity (See ✨ View any unpublished commerce_product RTBC ).

Unfortunately I think this needs to be addressed in core, @berdir mentioned this is minimally maintained and this is not a security issue. I've been meaning to find the corresponding core issue but I haven't had the time yet.

Attached is the patch file for MR 39
In case someone needs a static patch

Not exactly the way this is supposed to be managed but there was a release yesterday bringing this module to 1.6.0 and it looks like this work has been committed there.

No, this is definitely not in the release. It might conflict with that though, I didn't test that.

update patch to changes in 1.6 version

Please update the mr