SEO Admin role gets 403 on the Metatag defaults and Simple XML Sitemap settings screens

Problem/Motivation

The SEO Admin role cannot reach the two primary SEO configuration screens. Both return HTTP 403:

• /admin/config/search/metatag — Metatag defaults
• /admin/config/search/simplesitemap — Simple XML Sitemap settings

The role reaches only /admin/config/search/path and /admin/config/search/redirect, which return 200. Both failing routes work for a Super Admin, so the modules and routes are present — this is a permission gap, not a routing or missing-module problem.

This recipe already grants to user.role.seo_admin, but only two permissions:

user.role.seo_admin:
  grantPermissions:
    - 'administer redirects'
    - 'use yoast seo'

Meanwhile the recipe installs metatag and simple_sitemap, so it is this recipe that creates the permissions the role is missing. varbase_users_base cannot grant them, because at the point it runs those modules are not installed and the permissions do not yet exist. That makes this the right place for the fix.

Reproduced identically on three independently provisioned sandboxes — Varbase Starter, Educare and Horizon Aid — which is consistent with a shared distribution default rather than a per-site misconfiguration.

Steps to reproduce

1. Install a site that applies the Varbase SEO Base recipe.
2. Log in as a user holding only the SEO Admin role, or masquerade as one from a Super Admin account.
3. Visit /admin/config/search/metatag — 403.
4. Visit /admin/config/search/simplesitemap — 403.
5. Visit the same two paths as Super Admin — 200 on both.

Proposed resolution

Grant the two permissions the role needs to do its stated job, in the recipe that installs the modules providing them:

user.role.seo_admin:
  grantPermissions:
    - 'administer redirects'
    - 'use yoast seo'
    - 'administer meta tags'
    - 'administer sitemap settings'

Machine names verified against the modules' own *.permissions.yml: administer meta tags is provided by metatag, and administer sitemap settings by simple_sitemap. Both are declared restrict access: TRUE upstream, which is expected for administrative settings screens and appropriate for a role named for SEO administration.

Scope is deliberately the SEO Admin role only, matching the report. Whether site_admin should also carry these is a separate judgement and is not changed here.

Remaining tasks

• ✅ File an issue
• ❌ Addition/Change/Update/Fix
• ❌ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Update Release Notes
• ❌ Release

User interface changes

• The SEO Admin role gains access to the Metatag defaults and Simple XML Sitemap settings screens.

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• Grant the SEO Admin role the "Administer meta tags" and "Administer sitemap settings" permissions, so it can reach the Metatag defaults and Simple XML Sitemap settings screens it is named for. Both returned 403 before.

AI-Generated: Yes