Deleting a menu link from the node edit form does not apply hook_ENTITY_TYPE_access()

There is a similar problem with hook_menu_link_content_create_access().
If you add this hook:

function test_menu_link_content_create_access() {
  return Drupal\Core\Access\AccessResult::forbidden();
}

Users with the "administer menu" permission can't use the menu link add form, but can still add a menu link when using the node edit form.

Is the inverse also true where users without permissions can create menu items through the node edit page?

Is the inverse also true where users without permissions can create menu items through the node edit page?

Without the patch: users explicitly need the "administer menu" permission to create menu items through the node edit page.
With the patch: users need menu link create access (this can be achieved with the "administer menu permission" or with some custom hoook_create_access).

Left some small comments in MR

If you are another contributor eager to jump in, please allow the previous poster at least 48 hours to respond to feedback first, so they have the opportunity to finish what they started!

Believe feedback has been addressed on this one.

This looks good, I had to double check the menu link content access handler actually checks the administer menu permission for both edit and delete but it does, so this can only tighten access rather than loosen it.

Committed/pushed to 11.x, thanks!

catch → closed merge request !11321

Automatically closed - issue fixed for 2 weeks with no activity.