Document that EntityAccessControlHandler::checkFieldAccess returns AccessResultAllowedByDefault

Akhil Babu → made their first commit to this issue’s fork.

Function definition of was updated in https://www.drupal.org/project/drupal/issues/3395404 🐛 Information disclosure access bypass for revision log fields when the JSON:API module is enabled Fixed

This means that all fields are editable if the user has 'update' access to the entity.

Is this valid now? Update access is checked only for the revision log field in the new definition.

  protected function checkFieldAccess($operation, FieldDefinitionInterface $field_definition, AccountInterface $account, FieldItemListInterface $items = NULL) {
    if (!$items instanceof FieldItemListInterface || $operation !== 'view') {
      return AccessResult::allowed();
    }
    $entity = $items->getEntity();
    $isRevisionLogField = $this->entityType instanceof ContentEntityTypeInterface && $field_definition->getName() === $this->entityType->getRevisionMetadataKey('revision_log_message');
    if ($entity && $isRevisionLogField) {
      // The revision log should only be visible to those who can view the
      // revisions OR edit the entity.
      return $entity->access('view revision', $account, TRUE)
        ->orIf($entity->access('update', $account, TRUE));
    }
    return AccessResult::allowed();
  }

I think its fine to say 'With a few exceptions, most fields return access result allowed by default'

There are other exceptions in e.g. comments

Is this valid now?

yes it is. Let me emphasize a part of the code you pasted above:

    if ($operation !== 'view') {
      return AccessResult::allowed();
    }

What needs to be documented here is you can not rely on fieldAccess alone to check whether a field is accessible by a user, it must be andIf'd with entity access.

Thanks @larowlan and @Ghost of Drupal Past

I have updated function documentation as per the inputs.

Can it be documented in the issue summary why

\Drupal\Core\Field\FieldItemList::access

does not need to be updated.

Updated the issue summary as suggested.