When an anonymous user is editing an entity with private files they can get the following error: "You do not have access to the referenced entity (file: file_id)."

<?php
// each of a delta-keyed array
foreach ($referenced_entities as $ref) {  
  // $ref->id() points to fid in my case which is e.g. 3018, soooo....
  if (isset($referenced_entities[$ref->id()])) { 
    // never hits here
  }
}
?>

+1 for the patch, existing code makes no sense, at least in my use case of "10 files attached to a user profile".

Having tested this patch, can confirm it removes the immediately offending errors.

It didn't fix an underlying problem with access checks that I'm having, but this was definitely blocking progress.

Thanks for reporting this issue.

I'm not sure if this is the correct fix or not, but either way, we would definitely need an automated test that fails without the fix and passes with it. Tagging "Needs tests" for that. Thanks!

I had this problem with an authenticate user and user_picture in the public folder.

The patch did not work, at first. It did work once I changed the storage of the user_picture to private.

I didn't have time to investigate further, ping me if you anyone wants more details. (And it's strange because it worked a couple of days ago with the public folder, and no patch.).

Crossing my fingers it holds.

Ok, we will send you a white dove with a message...

I can confirm this patch works on a D9.4.11 PHP8.1 site. I don't have this problem anymore on D9.5.x sites

Just ran into this issue after updating from Drupal 9 to Drupal 10 for existing media entities. No ideas why this comes up now, but perhaps something related was fixed, which is now causing this issue...?

Thanks for the patch, ran into the same problem as @Anybody listed. In my case though only in a media field (not private) provided in a paragraph, was only discovered by accident because this field is rarely used. The patch fixes the problem, successfully tested on Drupal 10.1.6

RTBC++

I will try to create test case.

I created test as described in the IS, but I was not able to get the error on 10.2.x-dev.
Issue targeted on 10.1.x let's see how pipeline will result.

I was not able to reproduce the issue.
You can check test case in the MR.
Needs more info, how to reproduce it.

Oops.
Made commit to wrong branch.
Revert changes.

Initial patch didn't work for me, so attaching the patch, which fixed the issue.
My issue is following:
1) Drupal 9.5.11, webform module 6.1.5, default download method is private
2) There is webform, which is accessible by anonymous users and contains upload field of type `Document file`.
3) When admin tries to update submission via edit page `admin/structure/webform/manage/form_name/submission/1/edit`, there is same error, as mentioned in title.
Not sure, if my fix is proper one, but it seems logical to check `download` operation instead of `view` for files, which can be downloaded, but can't be viewed.