Remove the edit canvas global regions permission, as it is stripped with a warning on a Drupal CMS base

Problem/Motivation

recipe.yml grants edit canvas global regions to site_admin (line 222). On a plain Drupal CMS base that permission does not exist at the moment the role is written, so Drupal silently strips it and logs:

Non-existent permission(s) assigned to role "Site Admin" (site_admin) were removed.
Invalid permission(s): edit canvas global regions

Observed on a fresh drupal/cms build with the Horizon Aid site template, in the site's own log after install. It is the only permission in the recipe that behaves this way.

The permission is not upstream. It is added by a Vardot patch: vardot/varbase-patches carries feat: #3584713 Add Allow Edit Global Regions permission to restrict editing of global page regions (canvas--2026-08-13--3584713--mr-911.patch), which adds edit canvas global regions to canvas.permissions.yml and the matching access check to canvas.module. So the permission exists only where vardot/varbase-patches is applied. A plain Drupal CMS build does not require varbase-patches, which is exactly why the permission is missing there and the grant is stripped.

Steps to reproduce

1. Build a plain Drupal CMS project and require a Vardot site template that applies this recipe.
2. Install through the site template picker.
3. drush watchdog:show --severity=Error, or query the log table: the message above is present.
4. Check the role: site_admin does not hold edit canvas global regions.

Proposed resolution

Remove the edit canvas global regions line from the site_admin grant in recipe.yml. Nothing else changes.

Trade-off, stated rather than assumed: on a Varbase base the patch is applied and the grant works today, so removing the line means site_admin no longer gets it there either. This is being done together with removing the #3584713 patch from vardot/varbase-patches, so the permission stops existing anywhere rather than existing on one base and not the other.

What was done

Both halves are complete, so the permission no longer exists on any base rather than existing on one and not the other:

• This recipe: the edit canvas global regions grant removed from site_admin — merged to 1.0.x.
• vardot/varbase-patches: the #3584713 "Allow Edit Global Regions" patch entry for drupal/canvas removed — issue #620, PR #621, released in 11.0.41. Only the 11.0.x branch carried it. The dated patch files on the patches branch are left in place, since that branch is an immutable store and a published composer.lock may still reference them.

Direction this follows

This is part of a deliberate move to follow the Drupal CMS and Drupal Canvas teams on logic and design, rather than carrying our own parallel behaviour:

• Minimal additions. Prefer what Drupal CMS and Drupal Canvas already provide over adding a Vardot-only concept.
• Minimal changes and minimal patches. A patch that introduces a permission, an access check or an API that upstream does not have creates two different products: one where varbase-patches is applied and one where it is not. This issue is exactly that failure mode surfacing — a recipe granting a permission that only exists behind a patch.
• Work items aligned upstream. Where behaviour is genuinely needed, take it to the Drupal CMS / Drupal Canvas issue queues and follow their design, instead of maintaining it downstream as a patch.

Anything Varbase still needs here should be raised with those teams first, and only patched locally when there is no upstream path.

Remaining tasks

• ✅ File an issue
• ❌ Addition/Change/Update/Fix
• ❌ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Update Release Notes
• ❌ Release

User interface changes

• On Varbase, Site Admin loses the Drupal Canvas "Allow Edit Global Regions" permission. On Drupal CMS nothing changes, because the permission was already being stripped.

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• Remove the edit canvas global regions permission from the Site Admin role, as it is stripped with a warning when the recipe is applied on a Drupal CMS base.

AI-Generated: Yes