Add a dedicated 'administer book settings' permission for Book module settings page

Created on 1 July 2025, 14 days ago

Problem/Motivation

The Book module's settings page (`/admin/structure/book/settings`) currently uses the broad `administer site configuration` permission. This allows users to access all site configuration pages, which is excessive for someone who only needs to manage Book settings.

Steps to reproduce

A user without the `administer site configuration` permission is denied access to the Book module settings form at `/admin/structure/book/settings`.

Proposed resolution

  • Introduce a new custom permission: `administer book settings`.
  • Restrict access to the Book settings form using this new permission.
  • Update:
  • - `book.permissions.yml` to define the permission
    - `book.routing.yml` to apply it to the settings route

Remaining tasks

User interface changes

N/A

API changes

N/A

Data model changes

N/A

✨ Feature request
Status

Active

Version

3.0

Component

Code

Created by

πŸ‡¦πŸ‡ΊAustralia tarawij

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @tarawij
  • Pipeline finished with Success
    14 days ago
    Total: 577s
    #535838
  • Pipeline finished with Success
    14 days ago
    Total: 443s
    #535876
  • πŸ‡¦πŸ‡ΊAustralia tarawij

    I've pushed an initial patch to the issue fork branch 3533308-add-a-dedicated-permission.

    This patch introduces a new administer book settings permission and updates the route access for the Book module’s settings page (/admin/structure/book/settings) to use it, replacing the broader administer site configuration permission.

    It also includes a functional test (BookSettingsAccessTest) to verify access for users with and without the new permission.

    This patch does not include an update hook, so sites will need to assign the new permission to roles manually.

    Kindly requesting a review when convenient, happy to revise or expand on the patch as needed. Thank you!

  • Pipeline finished with Success
    13 days ago
    Total: 239s
    #536340
  • Pipeline finished with Success
    13 days ago
    Total: 237s
    #536786
  • Pipeline finished with Success
    12 days ago
    Total: 259s
    #537784
  • πŸ‡¦πŸ‡ΊAustralia tarawij

    Updated the patch to include an update hook for backward compatibility.

    Added `book_update_103007()` which automatically grants the new 'administer book settings' permission to existing roles that have 'administer site configuration'. This ensures no access disruptions during upgrades.

    The patch now provides a complete solution with automatic permission migration for existing sites.

  • πŸ‡¦πŸ‡ΊAustralia tarawij
  • I have reviewed and tested the patch. After applying it and running 'drush updatedb', a new 'Administer book settings' permission appears. This permission allows access to the book settings page at '/admin/structure/book/settings'.

    Users who already have the 'Administer site configuration' permission are automatically granted the new 'Administer book settings' permission.

    Test environment:
    Local vanilla GovCMS site
    Drupal Core: 11.2.1
    drupal/book: 3.0.0-alpha2

  • Reviewed this, looks good, has update hook and tests, works as expected. Moving to RTBC

Production build 0.71.5 2024