Permissions do not work correctly

Hello,
Patch is working for me. Under operations y don't see "Clone" link. Thanks!

Applied patch against 1.0.0-beta3 and it's working perfectly for me.
+1 RTBC

I could not re-create the issue. I created a new role Editor, which had clone permission set to "Clone all Menu entities.". When I logged in with the user that has the role Editor I could not clone the content, just the menus. Looking at the provided patch, it does exactly the same as what the code without the patch does, except it adds additional cache contexts. Not sure if the problem was caching as I did not have the problem. So leaving it as needs review and letting somebody else to test it also.

Hi, @keopx can you post the steps to reproduce this issue I'm having the same problems as @DeaOm.

Regards

Did a quick reroll against latest dev

Re #5 and #6 I can also confirm this problem. It's simple to reproduce for example with blocks and nodes:

2. Give a user a permission-limited role. Only grant "Clone all Content entities" permission.
3. Open admin/structure/block/block-content
4. In the operations on the right there's a "Clone" option, which should not exist as the user has no permission.

Was able to reproduce the error following the steps of comment #8 and the patch #7 is able to fix it.

Before patch, user "a"shouldn't be able to clone block contents, but them are:

After the patch, user can't clone block content:

patch #7 works for me

Confirming #7 fixes the issue for me.

In my case, an anonymous user was allowed to clone certain entity types. This patch prevents it.

Updating priority and tags given the access bypass identified in comment #11. Fixing the access bypass should block a full 1.0 release of the module.

While patch #7 works, it does not check if the user has permission to create the entities. See issue #3011466: Respect the entity create permission.

Attached an improvement which should solve both issues.

Patch #13 is working fine. Marking it to RTBC

It's a good point that the user needs to have access to create the entity but we should use the access handler for checking the create access.

Here is a patch that checks this and also a kernel test for testing the access to the route.

Please take a look.

Forgot the test in the wrong namespace.

Forgot the test group as well of course. Let's see what else fails now.

Yeah, broke some existing tests. Fixed with adding permissions.

Encountered also some entity types which don't have a say in their access control handler as to how a user can get an allowed access returned, so for those, I added an exception to the check for create access.

Patch #19 fixes the issue when entity without clone permission was able to be cloned (see example with Block content above).
Also it takes into account "create" entity permission - if user can't create an entity, he won't be able to clone the entity.

I reviewed the #19 patch. Works correctly for me, and the create permission was a necessary addition.

Merged.

Crediting.