In tool_belt/modules/tool_belt_content_translation/src/Plugin/tool/Tool/EntityTranslationGet.php, the checkAccess method allows the use of the plugin only if one of the following permission is enabled: "translate $entity_type_id entities" or 'administer content translation'. However, the "translate $entity_type_id entities" does not exist for entity types using bundles. For these, permissions exist by bundle only.

Issue fork tool_belt-3590578

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

nicolasgraph created an issue. See original summary.

nicolasgraph’s picture

Status: Active » Needs review
nicolasgraph’s picture

Status: Needs review » Needs work

Back to Needs work, while it works for nodes, it doesn't for paragraphs.
We probably need to check both permission patterns.

nicolasgraph’s picture

Status: Needs work » Needs review
jaydub’s picture

I can verify that this MR fixes the incorrect permissions for content translation. In my case I only tested the narrowest updated permission of 'translate $bundle $entity_type_id'.

On a totally separate matter, this tool does an entity access check for 'update'. If you have workflow/content_moderation in place on your Drupal site, the user executing the tool will also need one or more of the content moderation's use state transition permissions. For example in my case, until I had also set 'use $workflow transition $state' permission(s) that corresponded with the workflow and state(s) that the node entity that was being checked in this tool, I would get a tool access denied on the 'update' entity access check. See ./core/modules/content_moderation/src/Permissions.php

ajits’s picture

Assigned: Unassigned » ajits

Checking this now.

nitinkumar_7’s picture

Assigned: ajits » Unassigned
Status: Needs review » Reviewed & tested by the community

Reviewed the MR. The fix correctly addresses the original bug by replacing the broken "translate $entity_type_id entities" permission check with a bundle-aware approach that handles both bundled entities (nodes, media etc...) and entities that don't use bundle granularity for translation permissions.
The use of a separate "$bundle_translation_permission" guarded by "isset()" is the right pattern here : it avoids checking a non-existent permission when the bundle equals the entity type ID.

The addition of 'translate any entity' as a fallback is also a nice improvement over the original.

Marking as RTBC. One follow-up suggestion for a separate issue: it would be good to have a kernel test covering at least nodes, paragraphs, and a non-bundled entity type to prevent regressions on the access logic.

ajits’s picture

Assigned: Unassigned » ajits

I am still checking this. The above reads like an AI review.

ajits’s picture

Assigned: ajits » Unassigned
Status: Reviewed & tested by the community » Fixed

Updated the MR with the translation access check from core.

This should also handle the issue reported by @jaydub about workflow/content_moderation

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.