Added proper entity access checks on Maestro notification preview routes

Author: rimi-itk

CHANGELOG.md

@@ -11,6 +11,9 @@ before starting to add changes. Use example [placed in the end of the page](#exa
 
 ## [Unreleased]
 
+- [PR-307](https://github.com/OS2Forms/os2forms/pull/307)
+  Added proper entity access checks on Maestro notification preview routes
+
 ## [5.0.0] 2025-11-18
 
 - [PR-192](https://github.com/OS2Forms/os2forms/pull/192)

modules/os2forms_forloeb/os2forms_forloeb.routing.yml

@@ -17,7 +17,7 @@ os2forms_forloeb.meastro_notification.preview:
       webform:
         type: 'entity:webform'
   requirements:
-    _permission: 'view any webform submission'
+    _entity_access: 'webform.view'
 
 os2forms_forloeb.meastro_notification.preview_render:
   path: '/admin/structure/webform/manage/{webform}/os2forms_forloeb/notification/{handler}/preview/{notification_type}/{content_type}/render/{submission}'
@@ -31,7 +31,7 @@ os2forms_forloeb.meastro_notification.preview_render:
       submission:
         type: 'entity:webform_submission'
   requirements:
-    _permission: 'view any webform submission'
+    _entity_access: 'submission.view'
 
 os2forms_forloeb.meastro_notification.preview_message:
   path: '/os2forms_forloeb/notification/message'