Create React Permission Utilities

As long as we agree on what the server will pass to the client in 📌 Pass current user's XB permissions to the XB UI Active , work on this could begin in parallel. But that probably makes little sense?

📌 Pass current user's XB permissions to the XB UI Active is finished, can the updated and agreed upon format be updated here? Are we using raw permissions from Drupal or should it be createPage, etc because that is not what was done in the other ticket.

@mglaman That includes the config-related permissions, which are all-or-nothing so are just flags. But we might want to still postpone on 📌 Update `ApiContentControllers::list()` to expose available content entity operations in `meta` Active for the content related ones.

#4++

Given that this could otherwise result in information disclosure vulnerabilities (not access bypass because the server side pieces are taken care of, at least once 📌 [PP-1] Add entity access checks to routes that deal with entities Postponed + 📌 [PP-1] Update `experience_builder.(experience_builder|api.layout.get) routes` to respect content entity update/field edit access of edited XB field Active are done), going ahead and tagging this a blocker for 🌱 Milestone 1.0.0-beta1: Start creating non-throwaway sites Active .

Adding #4's + #5's as related issues, to improve discoverability.

📌 Update `ApiContentControllers::list()` to expose available content entity operations in `meta` Active landed.

Added the different scenarios of permissions that need to be exposed to the client UI.

just formatting

In the interests of keeping things as simple as possible on the FE, I was hoping to get something like the following

JSON:

{
  "drupalSettings": {
    "xb": {
      [...]
      "permissions": [
        "read global regions", "update global regions", "delete global regions", "read sections", "update sections", "delete sections", ...
      ],
    }
  }
}

Because then in the UI checking if we should display a button or not is as simple as, for example:

JSX:

<>
    {drupalSettings.xb.permissions.includes('delete sections') && (
        <button>Delete section</button>
    )}
</>

Amazing 😍
NW per @larowlan review and I think I spotted a wrong permission check, but this looks amazing already and covers more scope than I expected.

penyaskito → credited larowlan → .