Access custom blocks in draft mode

Problem/Motivation

The Access Unpublished module currently provides the ability to view nodes in draft or unpublished status for users with the appropriate permissions. However, this functionality does not extend to custom blocks (block_content entities) that are in a draft state due to content moderation or workflow.

This limitation prevents editorial roles from being able to preview or interact with draft custom blocks, hindering content staging and review processes for these content elements.

It has been observed that draft or unpublished content and blocks in admin mode can be viewed using access tokens. However, this is not the case for draft blocks that do not have explicit permission restrictions applied to them. This suggests that the core access mechanism can function for blocks, but the Access Unpublished module is not consistently applying the necessary overrides for draft block_content entities, particularly those without specific permission constraints.

Steps to reproduce

1. Enable the Access Unpublished module.
2. Create a custom block of the moderated type and save it as a draft.
3. As a user with a role that has "view draft content" permission (granted by Access Unpublished for nodes) but not necessarily specific block permissions, attempt to view a page where this draft custom block is placed.
4. Observe that the draft custom block is not visible.
5. Confirm that draft nodes are viewable by the same user in similar scenarios.
6. (Additional Step) As an anonymous user, Use the access token and attempt to view the published block. Observe that it is viewable.
7. (Additional Step) Create a draft custom block of a type that does not have content moderation enabled or specific view permissions applied. Attempt to view this block as a non-administrator user with access token from Access Unpublished module. Observe that it is not visible.

Proposed resolution

The proposed resolution is to extend the Access Unpublished module's functionality to include block_content entities. This would involve:

• Reviewing the module's code to identify where access checks are performed.
• Implementing logic to apply similar access overrides to block_content entities that are in a draft or unpublished state, regardless of whether they have explicit permission restrictions.
• Potentially adding or adjusting permissions within the Access Unpublished module to specifically control the viewing of draft/unpublished custom blocks.

This would allow users with the necessary permissions to preview and interact with draft custom blocks in a similar way to how they currently interact with draft nodes.

Remaining tasks

• Investigate the Access Unpublished module's code to understand its current access control mechanisms.
• Develop a patch that extends the module's functionality to block_content entities, ensuring it handles cases with and without specific block permissions.
• Write automated tests to ensure the new functionality works as expected and doesn't introduce regressions.
• Submit the patch for review by the module maintainers.

User interface changes

Potentially, new permissions might be added to the Access Unpublished module's configuration page to control access to draft/unpublished custom blocks.

API changes

It's possible that internal API changes within the Access Unpublished module might be necessary to accommodate the block_content entity type.

Data model changes

No data model changes are anticipated.