[D9] Role Paywall

I recommend running some static analysis with PHPStan (see PHPStan for Drupal).

You can get it with composer via:

composer require --dev phpstan/phpstan \                     
  phpstan/extension-installer \
  mglaman/phpstan-drupal \
  phpstan/phpstan-deprecation-rules

Then run:

vendor/bin/phpstan analyze PATH_TO_MODULE --memory-limit 256M --level 0

Getting the level up to 5 is quiet healthy. With my configuration with PHP8.0 your module returns 8 errors on level 0 and 24 errors on level 5. I ignore some errors in a phpstan.neon file, which you can place in your root directory. It looks like this:

parameters:
  level: 5
  ignoreErrors:
    # new static() is a best practice in Drupal, so we cannot fix that.
    - "#^Unsafe usage of new static#"

A review needs to report what needs to be changed, although the review isn't required to be complete, nor to point out every single line that needs to be changed, especially when the same "error" is repeated more than once.

Thank you for applying! Reviewers will review the project files, describing what needs to be changed.

Please read Review process for security advisory coverage: What to expect for more details and Security advisory coverage application checklist to understand what reviewers look for. Tips for ensuring a smooth review gives some hints for a smother review.

To reviewers: Please read How to review security advisory coverage applications, What to cover in an application review, and Drupal.org security advisory coverage application workflow.

• This is a quick review that doesn't mean to be complete
• Each point describes what needs to be changed to have secure code that correctly uses the Drupal API and that follows the Drupal coding standards
• The review points are listed in order of importance as much as possible: first the points about security issues, then the points about code that doesn't correctly use the Drupal API; the points about wrong branch names, branch names that should be avoided because they are too similar, or code that doesn't follow the Drupal coding standards are listed for last
• What reported for each point could require changing more than a file, or more lines in the same file, not only the shown lines.

          return [
            'role_paywall' => [
              'title' => t('Role Paywall'),
              'description' => t('Configuration for the barrier block has changed. Please <a href="@edit_url">edit the block settings</a> and check the new <strong>Role Paywall</strong> visibity option.', $vars),
              'severity' => REQUIREMENT_ERROR,
            ],
          ];

The correct placeholders for URLs is :edit_url as described in FormattableMarkup::placeholderFormat().

  /**
   * The Role Paywall Access Rule plugin being configured.
   *
   * @var \Drupal\role_paywall\Plugin\RolePaywallAccessRulePluginInterface
   */
  private $plugin;

  /**
   * The Entity Type we are configuring this plugin for.
   *
   * @var string
   */
  private $entityType;

Private properties should be avoided in form classes, as those cause issues when the form instance is cached.

  public static function create(ContainerInterface $container) {
    $instance = parent::create($container);
    $instance->setPluginManager($container->get('plugin.manager.role_paywall_access_rule'));
    return $instance;
  }

The task of the create() method is passing the injected dependencies to the class constructor.

Test classes go all in the tests/src directory.

  /**
   * {@inheritdoc}
   */
  public function __construct(EntityTypeManagerInterface $entity_manager) {
    $this->entityTypeManager = $entity_manager;
  }

The documentation comment for the class constructor is the same documentation comment for a method that isn't inherited from the parent class or defined in a interface.

  /**
   * Get a list of all available content entities.
   */

The first line in the documentation comment should use a verb in the third person singular. The rest of the comment should document the parameters and the returned value.

  public static function create(ContainerInterface $container) {
    $instance = parent::create($container);
    $instance->pluginManager = $container->get('plugin.manager.role_paywall_access_rule');
    return $instance;
  }

The code is still not calling the class constructor. The code should be similar to the code used from RolePaywallPluginSettings::create().

  public static function create(ContainerInterface $container) {
    return new static($container->get('plugin.manager.role_paywall_access_rule'));
  }

Thank you for your contribution! I am going to update your account.

These are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find more contributors chatting on the Slack #contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

I thank all the dedicated reviewers as well.

That example is wrong.
Any class that implements ContainerInjectionInterface::create() calls the class constructor. The documentation itself says:

The factory should pass any needed dependencies into the constructor of this class, but not the container itself.

That's what Drupal core does, for example in CronForm::create() or RegionalForm::create().

public static function create(ContainerInterface $container) {
  return new static(
    $container->get('config.factory'), $container->get('country_manager')
  );
}