Per form based access permissions

+1 to submodule. Should possibly be a setting per form (to be protected or not) and default to public, similar to how field permissions work, otherwise it's always complicated to add new forms.

entity.contact_form.canonical route uses contact_form.view entity access, so we can hook into that easily.

I have worked on the implementation of this functionality.
https://www.drupal.org/sandbox/naveenvalecha/2725179
Following items are done :

• Add a 'protect' option to the contact form third party settings.
• Add a new permission for each contact form with 'protect' = TRUE
• Add a new access controller for viewing contact_form entities
• Use the base permission for those with protect = FALSE and the specific one for those with protect = TRUE

Pending action items :

• entity.contact_form.canonical route uses contact_form.view entity access, so we can hook into that easily.
• Add a new test
• Make it in a sub-module.

Here it goes the test with following features in patch :

• Add a 'protect' option to the contact form third party settings.
• Add a new permission for each contact form with 'protect' = TRUE
• Add a new access controller for viewing contact_form entities
• Use the base permission for those with protect = FALSE and the specific one for those with protect = TRUE
• Add a new test
• Make it in a sub-module.

Pending :

• entity.contact_form.canonical route uses contact_form.view entity access, so we can hook into that easily.

Questions :
Do we need a separate Readme.txt for the sub module ?

.

#9.1 Done
#9.2 Done
#9.3 Done
#9.4 Done
#9.5 Done
#9.7 Done
#9.8 Done
#9.9 Done

+++ b/modules/contact_permissions/src/ContactFormAccessControlHandler.php
@@ -0,0 +1,41 @@
+    elseif ($operation == 'delete' || $operation == 'update') {
+      // Do not allow the 'personal' form to be deleted, as it's used for
+      // the personal contact form.
+      return AccessResult::allowedIf($account->hasPermission('administer contact forms') && $entity->id() !== 'personal')->cachePerPermissions();
+    }

this is already in the parent, doesn't need to be duplicated.

If don't really like overriding the access control handler. Online one module can do this, whenever possible, we should work with the access hooks.

That means for this, we need to do a allow or forbidden, not allowedIf().

Patch looks good to me. @naveenvalecha can you please address #10 so that we can move forward here.

Accommodated #11

//Naveen

Here's the correct inter diff.

//Naveen

Here's the green patch.

Running the WTB on local is damn slow. Filed the task #2886713: Convert Tests to BTB from WTB to convert the tests to BTB

Over to @berdir

This landed #2886713: Convert Tests to BTB from WTB
Here's the updated patch. New test is damn fast compared to before.

$ ../vendor/bin/phpunit --filter testContactViewBuilder ../modules/contrib/contact_storage/modules/contact_permissions/tests/src/Functional/ContactAccessTest.php 
PHPUnit 4.8.35 by Sebastian Bergmann and contributors.

.

Time: 41.07 seconds, Memory: 6.00MB

OK (1 test, 10 assertions)

Excuse me, personal contact form has no options page, how to set the 'protect' option to it?

Thank you for the great job.

Did anyone looked at the module Contact Message Permissions?

It claims to be An extension of the core contact module that provides form-by-form permissions to access (edit/view/delete) message entities generated by these forms.

Not sure if this patch will ever make it in, but if so, D9 compatibility should be added to contact_permissions.info.yml

This seems like a good feature to replace the Contact Form Permissions module (which appears abandoned and doesn't have a supported release anymore). So I'm excited to see it in progress!

I've created a fork/MR from @naveenvalecha's patch in #18 and updated core version requirements.

I've also attempted to address @larowlan's requests in #22.

+++ b/modules/contact_permissions/src/ContactPermissions.php
@@ -0,0 +1,55 @@
+class ContactPermissions {
This needs to use \Drupal\Core\Entity\BundlePermissionHandlerTrait now so that we get the correct dependencies

I've added this, as I understand it -- but this is my first time handling permissions in Drupal 8+, so I may have missed something.

+++ b/modules/contact_permissions/contact_permissions.module
@@ -0,0 +1,61 @@
+ $entity_types['contact_form']->setAccessClass('\Drupal\contact_permissions\ContactFormAccessControlHandler');
we also need to switch the permissions route provider from EntityPermissionsRouteProviderWithCheck to EntityPermissionsRouteProvide

I'm actually not following this one -- I don't see where EntityPermissionsRouteProviderWithCheck is used. Nor have I been able to figure out the intent of the note with a little research. Happy to make changes if someone could clarify, though.