Latest revision gives access denied

Does this happen without multiversion, or is it a multiversion-specific bug?

Why decide? Let's do both. :-) That's probably best for UX.

Correct. That method is explicitly not user-access-aware. That needs to get checked externally by this patch.

1. +++ b/src/Access/LatestRevisionCheck.php
   @@ -18,13 +19,23 @@ class LatestRevisionCheck implements AccessInterface {
   -  public function __construct(ModerationInformationInterface $moderation_information) {
   +  public function __construct(ModerationInformationInterface $moderation_information, AccountInterface $current_user) {
        $this->moderationInfo = $moderation_information;
   +    $this->currentUser = $current_user;
      }
   

   The account can be passed into the access() method, as one of the many magic values it can request. See how PermissionAccessCheck does it.

2. +++ b/src/Access/LatestRevisionCheck.php
   @@ -48,7 +59,14 @@ class LatestRevisionCheck implements AccessInterface {
   +    $forward_revision = NULL;
   

   NULL is a bug. :-)

3. +++ b/src/Access/LatestRevisionCheck.php
   @@ -48,7 +59,14 @@ class LatestRevisionCheck implements AccessInterface {
   +    if ($this->moderationInfo->hasForwardRevision($entity)) {
   +      $forward_revision = $this->moderationInfo->getLatestRevision($entity->getEntityTypeId(), $entity->id());
   +    }
   

   getLatestRevision() isn't user-aware either.

Here's a totally new take.

The test in this patch adds a test for the class, but turns out the fix itself doesn't even need to touch the class. However, writing a proper test for that requires BrowserTestBase, and placing blocks to get the tabs to show up, and after an hour-plus of trying to make that work I am giving up and just trusting that it works because I am sick to death of our testing framework at this point. :-(

If testbot likes the rest of this patch, I'll merge it shortly.

Hm, need to tweak the permissions in the Simpletests. I keep forgetting those are even there.

Merged.

I have an issue with users who I want to view the Latest version tab, but I don't want them to have the 'View all unpublished content' permission, but only the 'View own unpublished content'. I have attached a patch for this particular situation.

I've also run into the problem of not wanting to give users the "View any unpublished content" permission.

Is there a reason that was decided as a requirement rather than "View own unpublished content?"

So far in my testing the change in #16 works fine but would like to know why "View any unpublished content" is required.