Problem/Motivation

myrest.permissions.yml defines only administer myrest, and the settings route is protected by the generic administer site configuration permission. There is no way to grant read access to the API separately from full administration.

Proposed resolution

  • Add access myrest api and administer myrest tokens permissions.
  • Change the settings route requirement to administer myrest.
  • Document the recommended permission set for the anonymous API consumer role.

Remaining tasks

Define permissions, update routes and resource access callbacks, document the setup.

User interface changes

New permissions on the permissions page.

API changes

Sites must grant the new permissions to keep existing access.

Issue fork myrest-3615491

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

sergeydruua created an issue. See original summary.

sergeydruua opened merge request !41

  • sergeydruua committed ce57edcd on 1.0.x 
    Issue #3615491: Introduce granular permissions for API resources
sergeydruua’s picture

sergeydruua commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

sergeydruua’s picture

sergeydruua commented
Status: Fixed » Closed (fixed)