Implement access controller for the menu and menu link entity

Looks good to me as a first step. We can deal with gutting _menu_link_translate() in the other issue.

Looks good to me, following the other issue. Committed/pushed to 8.x.

git errored out on me with access denied... Now pushed.

Not so ok :)

Wasn't retested and conflicted with AccountInterface. This should fix it, but it's untested.

Whoops and thanks, committed/pushed.

Actually reverted both the follow-up and the original patch, let's start back from this morning...

Combined the two patches.

Needs a reroll...

curl https://drupal.org/files/access-controllers-2012916-15.patch | git a
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 10669  100 10669    0     0   7739      0  0:00:01  0:00:01 --:--:--  9126
error: patch failed: core/modules/menu/menu.routing.yml:17
error: core/modules/menu/menu.routing.yml: patch does not apply

Working on reroll of #15

rerolled.

+++ b/core/modules/menu_link/lib/Drupal/menu_link/MenuLinkAccessController.phpundefined
@@ -0,0 +1,33 @@
+    $access = user_access('administer menu', $account);
+    if ($access && $operation == 'delete') {
+      // Only items created by the menu module can be deleted.
+      return $entity->module == 'menu';

Hm, so we have code for menu.module in the required menu_link.module.

We introduced a generic hook_$type_access() in the access controller base class, wondering if menu.module could implement this through that hook. Although I'm not quite sure how, maybe disallow delete by default and then menu.module allows to delete it's own menu links?

maybe disallow delete by default and then menu.module allows to delete it's own menu links?

Yes, I think that's a good plan.

Let's do that then :)

This looks like it overlaps with the RTBC #1984702: Convert menu.module's page callbacks to Controllers

@@ -0,0 +1,48 @@
+ * @see \Drupal\menu_link\Plugin\Core\Entity\MenuLink

Potentially we should also typehint the MenuLinkInterface

@@ -0,0 +1,34 @@
+    if ($operation == 'delete') {
...
+      $system_menus = menu_list_system_menus();
+      return !isset($system_menus[$entity->id()]);

Just wondering why we do not check for 'administer menu' as well.

@@ -0,0 +1,34 @@
+    return user_access('administer menu', $account);

This should be $account->hasPermission.

Looks great to me.

Except that I didn't catch that user_access() call.

Thanks!

Committed 972406d and pushed to 8.x. Thanks!