Since Drupal 10.2.0 entity types may declare a collection permission. See https://www.drupal.org/node/2955178 → or ✨ Allow entities to specify a "collection permission" Fixed . The permission providers, generate a "access {$entity_type_id} overview" permission, however, regardless of the value of the collection permission.
If the entity type specifies a collection permission use that in EntityPermissionProviderBase::buildPermissions().
Since the permission is used in \Drupal\entity\Routing\DefaultHtmlRouteProvider::getCollectionRoute(), add the same fallback there. Once Drupal 10.2.0 is required for Entity API, the whole override can probably just be removed, because core already does the same thing now for any entity with a collection permission, but for now this seems like the least disruptive change.
-
The generated overview/collection permission now actually matches the specified collection permission, if any. I don't think it's reasonable to assume that people explicitly specify a collection permission but then expect Entity API to generate a different permission, so I think in all cases this can be considered an improvement, even if it is technically a behavioral change.
-
Needs review
1.0
Core integration
Here we go. This is not extensively tested, but wanted to get the ball rolling.
Not sending for a test run, because tests seem to be broken still, as far as I can tell.