Problem/Motivation

The usability of having to go to the permissions page after you enable your resource is not great. I always forget to set permissions for my rest resource.

Proposed resolution

It would be nice to be able to enable it and at the same time there are checkboxes to enable permissions.

rest ui permissions

This would prevent lazy developers from having to go to the permissions page.

On the form /admin/config/services/rest/resource/myresource/edit, there should be a way to set the roles that can access the resource.

Remaining tasks

Review, test coverage?

User interface changes

API changes

Data model changes

Release notes snippet

Comments

oknate created an issue. See original summary.

oknate’s picture

Issue summary: View changes
oknate’s picture

Issue summary: View changes
oknate’s picture

Title: Allow setting permissions from config form » Allow setting resource permissions from config form
oknate’s picture

Issue summary: View changes
wim leers’s picture

Project: Drupal core » REST UI
Version: 8.8.x-dev » 8.x-1.x-dev
Component: rest.module » Code
Issue tags: +Usability

This UI is not provided by Drupal core, but by the contributed restui module.

clemens.tolboom’s picture

Issue summary: View changes
StatusFileSize
new8.84 KB
new28.91 KB

We do have rest-ui-permissions which I do overlook too sometimes.

We could list the permissions set like

clemens.tolboom’s picture

Status: Active » Needs review
StatusFileSize
new3.93 KB

I managed to get all permissions listed but this must be filtered out per rest resource. Not sure how to get there. Should we use \Drupal\rest\RestPermissions ?

clemens.tolboom’s picture

StatusFileSize
new33.42 KB

This is not useful:

clemens.tolboom’s picture

Issue summary: View changes

Filter permissions based on current resource.

Resources are entity based and permissions are bundle based.

oknate’s picture

I tested a little bit and #8 isn't what I was imagining.

I have permissions like - 'restful get recent_articles' from custom rest plugins
those were what I was thinking could be added.

clemens.tolboom’s picture

Status: Needs review » Active

I tested a little bit and #8 isn't what I was imagining.

@oknate I still have no clue how to list permissions related to a resource. Do you?

Patch #8 was just a mockup so setting back to active.

oknate’s picture

Issue summary: View changes
StatusFileSize
new164.95 KB
oknate’s picture

Status: Active » Needs review
StatusFileSize
new5.57 KB

Here's an initial patch. It's pretty much what I imagined.

rest ui permissions

oknate’s picture

Issue summary: View changes
oknate’s picture

StatusFileSize
new1.56 KB
new7.13 KB

Adding test coverage.

oknate’s picture

StatusFileSize
new1.56 KB

wrong interdiff, here's an update.

oknate’s picture

StatusFileSize
new7.05 KB
new647 bytes

Minor update, I saw I had one line duplicated in the test.

clemens.tolboom’s picture

It would be nice to be able to enable it and at the same time there are checkboxes to enable permissions.

So I misread it by putting it on the list page (doh).

@oknate your patch looks great and saves lots of navigation clicks :-) ... due to holidays I can test after 3 weeks :-/

oknate’s picture

No problem, enjoy your holidays!

clemens.tolboom’s picture

Status: Needs review » Needs work

The permissions form does not show up.

+++ b/src/Form/RestUIForm.php
@@ -340,6 +401,11 @@ class RestUIForm extends ConfigFormBase {
+    $permissions = $plugin->permissions();
+    if (!empty($permissions)) {

This is always empty done in www/core/modules/rest/src/Plugin/rest/resource/EntityResource.php:366

oknate’s picture

It wasn't empty when I took the screenshot in #14. What resource are you testing with? When I get a chance, I'll try to find resources that don't have permissions, and see what happens with them. My guess is, if the permissions are empty, it's fine for it not to render the form. I'll have to check if there are more general permissions in those cases. It's been a while since I looked a this.

clemens.tolboom’s picture

So

Shows permissions

- http://drupal.d8/admin/config/services/rest/resource/dblog/edit which plugin is a Drupal\\dblog\\Plugin\\rest\\resource\\DBLogResource

Does not show permissions

- http://drupal.d8/admin/config/services/rest/resource/entity%3Anode/edit does not show permissions
- http://drupal.d8/admin/config/services/rest/resource/entity%3Auser/edit
- several others including (readonly) which are AFAIK config entities

are all core/modules/rest/src/Plugin/rest/resource/EntityResource.php:358 which all do

  public function permissions() {
    // @see https://www.drupal.org/node/2664780
    if ($this->configFactory->get('rest.settings')->get('bc_entity_resource_permissions')) {
      // The default Drupal 8.0.x and 8.1.x behavior.
      return parent::permissions();
    }
    else {
      // The default Drupal 8.2.x behavior.
      return [];
    }
  }

Hope that helps!

clemens.tolboom’s picture

@oknate what shall we do with this issue?