Cache redirect error displayed when using 'view own unpublished content' permission alongside node grants

Problem/Motivation

Since upgrading to 10.4.1 I have seen a user warning about overwriting cache redirects:

User warning: Trying to overwrite a cache redirect with one that has nothing in common, old one at address "languages:language_interface, theme, user.permissions, route" was pointing to "user", new one points to "user.node_grants:view". in Drupal\Core\Cache\VariationCache->set() (line 138 of /app/web/core/lib/Drupal/Core/Cache/VariationCache.php).

Debugging on 11.x I was able to reproduce it. It is coming from the local tasks for nodes under certain conditions after the entity status is changed.

It appears that when the user has the view own unpublished content permission and the node is not published then the node access handler returns access with the user.permissions context added by the checkViewAccess method.

When the node is published checkViewAccess returns NULL and so the parent call continues down to where $access_result = $this->grantStorage->access($node, $operation, $account); is called. At this point if there is an implementation of hook_node_grants then NodeGrantDatabaseStorage adds the user.node_grants:view context.

This difference seems to cause errors for variation cache works and when it renders the tabs after the status change produces the error.

> User warning: Trying to overwrite a cache redirect for "entity_view:block:stark_local_tasks:[languages:language_interface]=en:[route]=entity.node.canonical02d270e527ee2db38f14edbd305a4fea048b224ab212dd8a734fefc49e4a04ab:[theme]=stark:[user.permissions]=863125a601a1ef531f97c3f043764864a62066d84f76547712f32db5e29fa5eb" with one that has nothing in common, old one at address "languages:language_interface, theme, user.permissions, route" was pointing to "user.roles:authenticated, user", new one points to "user.node_grants:view". in Drupal\Core\Cache\VariationCache->set() (line 138 of core/lib/Drupal/Core/Cache/VariationCache.php).

Steps to reproduce

Refer to the automated test in the MR for minimal steps to reproduce. Summary of the steps below.

Setup:

1. Standard install of 11.x
2. Enable node_access_test_empty test module (or any module that implements node grants)
3. Create page content type - set default to not published
4. Ensure local tasks block is placed on the page
5. Create role with the following permissions: 'create page content', 'edit any page content', 'view own unpublished content'
6. Create an user with the above role

Flow:

1. As a user with the above role create a new page node (they must be the author)
2. View the node and ensure the local tabs are rendered
3. As admin or other user with appropriate permissions publish the node
4. As the original node author, view the published node again and you get the cache redirect error message

Proposed resolution

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet