Problem/Motivation

This issue follows up on the discussion in #2809291: Add "edit block $type" permissions

That issue adds per-block-content-type edit permissions. In that issue, contributors decided that create permissions should be handled in a followup issue in the interest of shipping a usable feature more quickly (i.e. the ability to edit existing block content entities).

Proposed resolution

Add a create block permission per block type.

Provide an easy way for users with the new permission to reach a block add form.

Completed tasks

Remaining tasks

User interface changes

  • Users with the new permission will be able to create new blocks on the site. Specifics TBD.

API changes

TBD.

Comments

gabesullice created an issue. See original summary.

benjifisher’s picture

I think this issue should be a sibling of #2809291: Add "edit block $type" permissions, not a child. One advantage is that we will be able to fix and close that issue while this issue's parent is still open.

benjifisher’s picture

I am adding #2571235: [regression] Roles should depend on objects that are building the granted permissions as a related issue. Whichever issue is fixed second will have to update the permissions callback to add dependencies. See the draft change record Permissions can define dependencies.

benjifisher’s picture

#2571235: [regression] Roles should depend on objects that are building the granted permissions is now fixed, and the change record I mentioned in #3 is no longer a draft.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

benjifisher’s picture

Copied from #2809291-106: Add "edit block $type" permissions:

What does it mean when a user has permission to 'create $entity_bundle block content'? Should they be able to create instances of that block type? Right now, it looks like users need to have the 'administer blocks' permission to be able to add any instances of a custom block type.

My use case:
I'm asking about this because layout builder creates instances of custom blocks. If a user doesn't have access to create an instance of a custom block in layout builder and but they have the 'create and edit custom blocks' permission, they can still create the block but they can't access the text formatter for any fields with formatted text. The 'edit $entity_bundle block content' permission works as expected, so once the custom block is created they are able to format their text as they like.

What I expected:
- A user I created with 'create test_block block content' should be able to create new instances of test_block custom blocks (hitting the block_content.add_form route).

What happened:
- The user was given Access Denied when they attempted to access the test_block creation page at /block/add/test_block

To replicate:
- Build a site with the patch from comment #2809291-101: Add "edit block $type" permissions
- Create a custom block type. In this example, I called mine test_block.
- Create a user, give them the 'create test_block block content' permission.
- Log in as that user and try to create a test_block at /block/add/test_block
- Get an Access Denied

From #108:

I checked the route with devel and it looks like the block_content.add_form route still uses the 'Administer Blocks' permission, not , which is what I would expect. I still got an access denied when trying to create new test_blocks while using Bartik as the admin theme.

and #109:

Yep, the routing still uses the hard-coded permissions.

So a) we need tests for the UI and b) we need to add an access handler. Might just be simpler to swap to use EntityController for this.

smustgrave’s picture

Status: Active » Closed (duplicate)

Closing as a duplicate of #1975064: Add more granular block content permissions since we are adding the permission to create $bundle block content permission.