Report stale Domain Access grants rather than publishing through them.

Testing three domains against live projects turned up a failure state the
routing work cannot see. Domain Access decides which domain serves which
node through node grants, and enabling it leaves Drupal's grants stale
until someone rebuilds. Until then every domain serves every page, so a
seed collects all of it and publishes one client's content into another
client's project. Every page reaches the correct project for the domain
being seeded, so the routing is right and nothing reports a problem.

Found the hard way: the first live seed of clienta pushed all 63 nodes
into static-test-a. After node_access_rebuild() the same seed collected
23, which is clienta's 20 plus the three unrestricted originals. So the
seed does respect domain access once the grants are current — content
scoping works, it just cannot be assumed.

Reported in two places rather than fixed silently. A warning on the status
report, and an error on quant:seed-queue, which is where the damage
happens and where someone is watching. Both name the consequence rather
than the mechanism.

Deliberately not rebuilding grants from an update hook. It rebuilds every
node's grants, which on a large site holds a deploy open for a long time,
and it would run for every site with Domain enabled including those whose
grants are fine. Node grants belong to Domain Access, not here.

Deliberately not refusing to publish either, unlike the unrecognised host
guard. An unrecognised host has no legitimate reading; a pending rebuild
does — the flag can be set while content is scoped correctly, and it stays
set until an administrator acts, which on a large site can be a while.

Only reported where it can do harm: domain_access enabled and two or more
domains configured.

Author: stooit

quant.install

@@ -6,9 +6,36 @@
  */
 
 use Drupal\Core\Database\Database;
+use Drupal\quant\PublishGuard;
 use Drupal\views\Entity\View;
 use Symfony\Component\Yaml\Yaml;
 
+/**
+ * Implements hook_requirements().
+ */
+function quant_requirements($phase) {
+  $requirements = [];
+
+  if ($phase !== 'runtime') {
+    return $requirements;
+  }
+
+  if (!PublishGuard::nodeGrantsAreStale()) {
+    return $requirements;
+  }
+
+  $requirements['quant_node_grants'] = [
+    'title' => t('Quant content scoping'),
+    'value' => t('Node grants need rebuilding'),
+    'severity' => REQUIREMENT_WARNING,
+    'description' => t('Domain Access decides which domain serves which content, and its grants are out of date. Until they are rebuilt every domain serves every page, so a Quant seed publishes one site\'s content into another site\'s project. The pages reach the right project for the domain that was seeded, so nothing reports an error. Rebuild permissions on the <a href=":url">status report</a>, then re-seed each domain.', [
+      ':url' => '/admin/reports/status',
+    ]),
+  ];
+
+  return $requirements;
+}
+
 /**
  * Perform setup tasks for Quant.
  */

src/Commands/QuantDrushCommands.php

@@ -6,6 +6,7 @@
 use Drush\Drush;
 use Drupal\Core\Form\FormState;
 use Drupal\quant\CliDomainContext;
+use Drupal\quant\PublishGuard;
 use Drupal\quant\Seed;
 use Drupal\quant\Event\CollectEntitiesEvent;
 use Drupal\quant\Event\CollectFilesEvent;
@@ -211,6 +212,13 @@ public function prepare($options = ['reset' => 'true']) {
       $this->output()->writeln("Active domain: {$domainId}. Target project: {$project}.");
     }
 
+    // Stale node grants make every domain serve every page, so this seed
+    // would collect another client's content and publish it here. It is
+    // routed correctly, so nothing downstream reports a problem.
+    if (PublishGuard::nodeGrantsAreStale()) {
+      $this->output()->writeln('<error>Domain Access grants are out of date. Every domain currently serves every page, so this seed will publish other sites\' content into this project. Rebuild permissions at /admin/reports/status first.</error>');
+    }
+
     $config = \Drupal::config('quant.settings');
 
     $queue_factory = QuantQueueFactory::getInstance();

src/PublishGuard.php

@@ -97,4 +97,49 @@ public static function logRefusal(string $what, ?string $host) : void {
     ]);
   }
 
+  /**
+   * Determines whether node grants are stale on a multi-domain site.
+   *
+   * Domain Access decides which domain serves which node, through node
+   * grants.
+   * Enabling it sets Drupal's needs-rebuild flag, and until someone rebuilds,
+   * every node is visible on every domain. A seed then collects all of it and
+   * publishes one client's pages into another client's project — correctly
+   * routed, but scoped wrongly, so nothing here notices.
+   *
+   * Reported rather than enforced. The flag means grants may be stale, not
+   * that they are, and it stays set until an administrator acts, which on a
+   * large site can be a while. Refusing to publish for that whole window
+   * would be worse than saying so loudly.
+   *
+   * @return bool
+   *   TRUE when a rebuild is outstanding and it could mis-scope content.
+   */
+  public static function nodeGrantsAreStale() : bool {
+    if (!\Drupal::hasContainer() || !\Drupal::hasService('module_handler')) {
+      return FALSE;
+    }
+
+    $moduleHandler = \Drupal::moduleHandler();
+
+    if (!$moduleHandler->moduleExists('domain_access') || !$moduleHandler->moduleExists('node')) {
+      return FALSE;
+    }
+
+    // With one domain there is nowhere else for content to go.
+    if (!\Drupal::hasService('entity_type.manager')) {
+      return FALSE;
+    }
+
+    $domains = \Drupal::entityTypeManager()->getStorage('domain')->loadMultiple();
+
+    if (count($domains) < 2) {
+      return FALSE;
+    }
+
+    $moduleHandler->loadInclude('node', 'module');
+
+    return function_exists('node_access_needs_rebuild') && node_access_needs_rebuild();
+  }
+
 }

tests/src/Kernel/PublishGuardWriteTest.php

@@ -116,4 +116,24 @@ public function testReadMethodsAreNotGuarded() {
     }
   }
 
+  /**
+   * Stale node grants are only reported where they can mis-scope content.
+   *
+   * Without domain_access there is nothing deciding which domain serves what,
+   * so a pending rebuild cannot send one client's pages to another. The
+   * positive case needs domain_access and two domains, and is covered by the
+   * end-to-end harness rather than here.
+   *
+   * @covers ::nodeGrantsAreStale
+   */
+  public function testGrantsCheckIsQuietWithoutDomainAccess() {
+    $this->assertFalse(\Drupal::moduleHandler()->moduleExists('domain_access'));
+
+    // True in core terms, but harmless without per-domain content.
+    \Drupal::moduleHandler()->loadInclude('node', 'module');
+    node_access_needs_rebuild(TRUE);
+
+    $this->assertFalse(PublishGuard::nodeGrantsAreStale());
+  }
+
 }