Add author on promotion to realize better permission control

Confirm this suggestion, very needed! Patch seems broken with current version of Commerce, I'll try to update it for current version. Or maybe @caseylau - you already have updated version of patch?

As workaround without patching module core, I solve this problem via adding uid field using hook:

use Drupal\Core\Field\BaseFieldDefinition;

function mymodule_entity_base_field_info(\Drupal\Core\Entity\EntityTypeInterface $entity_type) {
  $fields = array();

  if ($entity_type->id() === 'commerce_promotion') {
    $fields['owner'] = BaseFieldDefinition::create('entity_reference')
      ->setLabel('Owner')
      ->setSettings(array(
        'target_type' => 'user',
        'default_value' => 0,
      ))
      ->setDisplayOptions('form', [
        'type' => 'dynamic_entity_reference_default',
        'weight' => 0,
      ])
      ->setDisplayConfigurable('form', TRUE);
  }

  return $fields;
}

This needs tests and we should now be using the EntiyOwnerTrait introduced by #3073942: Commerce entities implementing EntityOwnerInterface should always return a UserInterface object.

This should do the trick.

We were missing the following:

  $entity_type = $definition_update_manager->getEntityType('commerce_promotion');
  $keys = $entity_type->getKeys();
  $keys['owner'] = 'uid';
  $entity_type->set('entity_keys', $keys);
  $definition_update_manager->updateEntityType($entity_type);

The initial default value for the field is set to the first admin user.

+++ b/modules/promotion/commerce_promotion.install
@@ -216,3 +217,47 @@ function commerce_promotion_update_8208() {
+  $admin_roles = \Drupal::entityTypeManager()
...
+    $query = \Drupal::entityTypeManager()

These queries need an accessCheck(FALSE).

Not sure what to do about the existing "update commerce_promotion" which no longer exists... Should we grant the "update any commerce_promotion" to roles having the "update commerce_promotion" permission?

Added code to grant the "update any commerce_promotion" permission to all roles having the "update commerce_promotion" permission.