Problem/Motivation
After lots and lots of debugging, I discovered in #2869426-39: EntityResource should add _entity_access requirement to REST routes why _entity_create_access just wouldn't work for the REST module: because the REST module does not limit its routes that create entities to a single bundle. And some entity types check create access based on the bundle!
This is ONLY a DX problem. It does NOT have security implications.
Proposed resolution
Rather than doing
// If we were unable to replace all placeholders, deny access.
if (strpos($bundle, '{') !== FALSE) {
return AccessResult::neutral();
}
which is incredibly unhelpful, specify a reason!
// If we were unable to replace all placeholders, deny access.
if (strpos($bundle, '{') !== FALSE) {
return AccessResult::neutral(sprintf("Could not find '%s' request argument, therefore cannot check create access.", $bundle));
}
No more 🤔😡🙀!
Remaining tasks
None.
User interface changes
Helpful reason.
API changes
None.
Data model changes
None.
Comments
Comment #2
wim leersComment #3
borisson_This looks great, and has test coverage. The data provider also has tests for this usecase.
Comment #4
alexpottCommitted d6f7a9c and pushed to 8.6.x. Thanks!