- 🇦🇺Australia mingsong 🇦🇺
Does the patch from #2 check the permission for current account?
What happen if a user update or delete an entity via JSON API when the according custom permission is enable but that user doesn't have the permission to do so?
As per issue title, some routes implement _entity_access. In those cases, creating custom permissions based on the route alone won't work.
Take the "administer date-time" permission for example, which is to allow people to view the list of date formats, and also allow them to create new formats, as well as to allow editing/deleting existing formats. That permission has the following routes configured:
So in theory, you've got everything required for the permission to work as expected. What happens in reality though is that people with roles that have that permission granted are only able to access the date/time formats listing page, and create new formats. They cannot edit/delete formats, as the operations dropbuttons are not being rendered at all.
The above also has the side effect of people being able to create a new format, but soon as they create it, they cannot edit/delete it.
Allow specifying entity access for permissions, and have that work.
There will be another column in the custom permissions configuration page, which will allow people to configure any required entity permissions.
TBD
TBD
Needs review
2.0
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Does the patch from #2 check the permission for current account?
What happen if a user update or delete an entity via JSON API when the according custom permission is enable but that user doesn't have the permission to do so?