Broken thumbnail access when the default download method is set to "Private local files served by Drupal."

Have you checked the user permissions?

I guess that, by default, private files are not accessible.

Thank you for your quick answer. Private files are only visible if some module (core or contrib) grants access to it. Usually, access to an image is given if the user has access to the content referencing the image.
So that if Video Embed Field uses private thumbnails, it must make sure the thumbnail access is granted if the user can view the entity which uses that thumbnail (this should be done with hook_file_download).

Actually I just discovered I had no problem with 2.5 because the thumbnail was always public before this change: https://git.drupalcode.org/project/video_embed_field/-/commit/acab726124...

After this commit, I suspect any website using private as default download method will have broken thumbnails (at least for newly embedded videos).

I'll try to propose a fix.

Thanks for having a look at this.

We could add a new "Access private video thumbnails" or similar permission as you suggested.

I made a fix which seems to work well, but I'm not sure of the best way to inject the services (see @todo). And tests might be needed?

Looks like a lot of technical debt we are adding there.

Are we sure it's the simplest way to do that?

Is there a way to re-enable the previous behavior while staying compatible with issue #3506832 🐛 Image style derivatives not being created due to schema mismatch Active requirements?

Yes, the alternative would be that thumbnails remain always public, not private, like it was before. But in that case 🐛 Image style derivatives not being created due to schema mismatch Active should be reverted and reopen to find another way to fix it.

Still, I guess it might be better to allow private thumbnails (which is what 🐛 Image style derivatives not being created due to schema mismatch Active tried to do), so that thumbnails of private/confidential videos do not appear publicly on the web to people unauthorized.

Hi @gaëlg, I mostly agree with your last comment.

How should we proceed next?

OK, I updated the issue summary to show what's still needed.