Node module must not set user.node_grants:* context if current user != acting user

🐛 Access cacheability is not correct when "view own unpublished content" is in use Needs work can be related but I am not sure.

🐛 NodeAccessControlHandler::checkAccess() does not add a necessary cache context Needs work is most probably totally wrong with this proposed change

-        return AccessResult::allowedIf($node->isPublished())->addCacheableDependency($node);
+        return AccessResult::allowedIf($node->isPublished())->addCacheableDependency($node)->cachePerUser();

Some todos in the MR and we need tests here

Can the issue summary be updated please.

@smustgrave please let me know if anything is still missing from the IS.

The Needs Review Queue Bot → tested this issue. It no longer applies to Drupal core. Therefore, this issue status is now "Needs work".

This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.

Consult the Drupal Contributor Guide → to find step-by-step guides for working with issues.