fix: Fix unpredictable false positive/negative of missing entity access check in function scope due to cache key conflict #475

Author: driskell

src/Type/EntityQuery/EntityQueryType.php

@@ -22,4 +22,9 @@ public function withAccessCheck(): self
 
         return $type;
     }
+
+    protected function describeAdditionalCacheKey(): string
+    {
+        return $this->hasAccessCheck ? 'with-access-check' : '';
+    }
 }

tests/src/Rules/EntityQueryHasAccessCheckRuleTest.php

@@ -86,5 +86,15 @@ public function cases(): \Generator
             [__DIR__ . '/data/bug-437.php'],
             []
         ];*/
+
+        yield 'bug-475.php' => [
+            [__DIR__.'/data/bug-475.php'],
+            []
+        ];
+
+        yield 'bug-475b.php' => [
+            [__DIR__.'/data/bug-475b.php'],
+            []
+        ];
     }
 }

tests/src/Rules/data/bug-475.php

@@ -0,0 +1,21 @@
+<?php
+
+/**
+ * Cache key differs outside of class so this is separate reproduction
+ *
+ * @return void
+ */
+function bug475Caching(): void
+{
+    // Here condition() return type will be cached as one that has no access check
+    \Drupal::entityQuery('node')
+        ->condition('field_test', 'foo', '=')
+        ->accessCheck(FALSE)
+        ->execute();
+
+    // Cache return on condition() will also be no access check, even though caller did, unless caller type changes cache key
+    \Drupal::entityQuery('node')
+        ->accessCheck(FALSE)
+        ->condition('field_test', 'foo', '=')
+        ->execute();
+}

tests/src/Rules/data/bug-475b.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace Bug475CacheKeyExample;
+
+/**
+ * Cache key differs if in class so this tests that too
+ *
+ * @return void
+ */
+class TestClass
+{
+    public function bug475Caching(): void
+    {
+        // Here condition() return type will be cached as one that has no access check
+        \Drupal::entityQuery('node')
+            ->condition('field_test', 'foo', '=')
+            ->accessCheck(FALSE)
+            ->execute();
+
+        // Cache return on condition() will also be no access check, even though caller did, unless caller type changes cache key
+        \Drupal::entityQuery('node')
+            ->accessCheck(FALSE)
+            ->condition('field_test', 'foo', '=')
+            ->execute();
+    }
+}