In EntityResource we return an exception based on $entity->access():
$entity_access = $entity->access('view', NULL, TRUE);
if (!$entity_access->isAllowed()) {
throw new CacheableAccessDeniedHttpException($entity_access, $entity_access->getReason() ?: $this->generateFallbackAccessDeniedMessage($entity, 'view'));
}
However in EntityResourceTestBase we check for messages either based on the entity type's admin_permission, or the operation.
Check for a message based on $entity->access() in EntityResourceTestBase.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | 2928887-2.patch | 936 bytes | timmillwood |
Comments
Comment #2
timmillwoodInitial patch
Comment #3
wim leersThat's because the messages generated in each entity type's access control handler cannot be predicted.
\Drupal\Tests\rest\Functional\EntityResource\EntityResourceTestBase::getExpectedUnauthorizedAccessMessage()merely provides a default that handles default functionality in\Drupal\Core\Entity\EntityAccessControlHandler.This is why every entity type's subclass of
EntityResourceTestBaseoverrides::getExpectedUnauthorizedAccessMessage()and adds expected entity type-specific messages. I think it'd be good to keep it that way, because it also ensures that we explicitly encode the expected message, which means regressions in that, and hence in the API-First DX, are detected too.(That is also why #2 passes.)
Comment #4
timmillwoodOk, I'll trust you. 😉