Restrict who can "Rebuild permissions" to users with the "administer site configuration" permission

Attached a patch supporting Drupal 10.0.x.

codebymikey → changed the visibility of the branch 3418353-restrict-who-can to hidden.

This would need an upgrade path to add the new permission to any role that has administer nodes so there's no access regression for existing sites. Also needs a reroll.

Updated the issue branch with changes from 11.x, added post_update hook to grant the new permission

The errors in the pipeline look to be unrelated to this issue, so I would assume MR could be reviewed now

I'm 50/50 that we should add test coverage for the update hook. We add coverage for most update hooks but this one is pretty simple.

But moving to NW as this would be a new permission to be declared.

Thanks for the feedback, @smustgrave

I added a simple test to verify that the new permission is added by the post update hook, just in case

CR added, I'm not sure if we also need a presave hook here for exported config in modules/profiles

All feedback for this one appears to be addressed!

The title doesn't match either the issue summary or the MR. Also I'm not entirely sure why that option wasn't taken - e.g. requiring both 'administer site configuration' and 'administer nodes' at the same time.

Updated title. I think a new permission is the best approach here, if we used administer site configuration we'd still need an upgrade path.

Keeping at NW because I think we do need the ConfigUpdater dance here in a presave hook

Added the presave hook but debugging locally and it doesn't fire during the post update...

After all that I'm actually unsure how we should do this. With this presave hook it's impossible now to save a role with administer nodes and without rebuild node access permissions...

Throwing a deprecation didn't feel right either because it's a valid case to have one permission without the other, but we need to be able to notify modules with exported config.

@catch any ideas?

I don't really count roles as exported config to be shipped with modules to be honest, it's pretty rare in general. So in the case I think it's fine to skip the presave. It's not like we're renaming a permission, exported roles will be validz they just might not cover this permission.

Perfect, in that case I've reverted all the presave code.

Working on https://www.drupal.org/community/contributor-guide/reference-information... → I tried the patch here, which is used as an example.

I then looked for "Rebuild node access permissions" in the user interface at /admin/people/permissions, but then realized that it is called "Rebuild content access permissions" ...

Should it perhaps be one or the other both places, for consistency?