I followed the Steps to reproduce Issue and got also no status field Publish, ...

I don't get the Issue: How should which ACL-Setting work?

The article category permission "Edit state" is not applied in this case. In my opinion, that is not a correct behavior.

The global permissions "Create" and "Edit state" work as expected.
The article category permission "Create" is applied,
but the article category permission "Edit state" is ignored.

So, why is the category permission "Create" applied, but "Edit state" is not and must be inherited from global permissions? Inheriting from global permissions might grant too many permissions to other article categories.

Thanks for Info, @chw-1. Why is this behavior you wrote is maybe a Question for experienced Dev. like @Bakual?

Sounds like a bug to me. It should be inherited the same way from the category as the "Create" one.

It is indeed a bug. At the moment, for new article, we only get edit state permission from com_content component and ignore the category permission, see https://github.com/joomla/joomla-cms/blob/staging/administrator/components/com_content/models/article.php#L367

Usually, that line would automatically also check the category permissions (as well as the component one) as part of the article one. That's implemented in the ACL already.
But in case of a new article, we do some kind of hack here to check for the category create permissions. There is no ACL inheritance set up yet since the article isn't saved yet.
As soon as it is saved, you can go edit it and change the state (I guess, haven't tested) as then the ACL "tree" is built and works.

So the state would need some special handling in case of a new article here as well. But this may be tricky to do.

Usually, that line would automatically also check the category permissions (as well as the component one) as part of the article one. That's implemented in the ACL already.

I don't think that code checks permission automatically as you said. It would work as you said if that code is somehow replaced with (need to

if (!$this->canEditState($item))

(of course we need to get $item object first).

I don't think that code checks permission automatically as you said.

If the article is stored correctly, $user->authorise('core.edit.state', 'com_content.article.1') will check first the article asset. If there is no specific permission set (the action inherits) then it checks the parent one (the assigned category). If that has no specific permissions set as well, it will again check the parent one (com_content component settings) and if that has it set to inherit as well, it will check again the parent one which in that case is the root one (global Joomla configuration).

That's how our ACL works ?

I understand how ACL works, I only said that the line of code https://github.com/joomla/joomla-cms/blob/staging/administrator/components/com_content/models/article.php#L367 doesn't work as you said (the line of code I mentioned applied for the case new article)

I also see something which doesn't look correct to me, will try to prepare a PR and show it to you :)

Ah, misunderstood you.
I think it should work when it checks for the category in case of a new article and preselected category.
I think the tricky part is what happens when the category is changed to another one where the user wouldn't be allowed to change the state.

OK. I made PR #13990 to fix this issue. Please help testing it so that we can get the issue fixed

@Bakual As mentioned, while reviewing the code, I found some issues with the code, so I improved it, too. I would be great if you can help review the code changes to make sure it is correct.

Closing this issue as there is a PR