To be able to create/update/delete Term entities via REST, one should not have to grant the 'administer taxonomy' permission

See #2808217-22: To be able to view Vocabulary config entities via REST, one should not have to grant the 'administer taxonomy' permission for an example of what the test coverage should look like.

#1038330: Allow specific vocabulary permissions to work on vocabulary admin pages hasn't been touched since September 2012. That's approaching its fifth birthday. I don't want to wait for that.

I'd actually say this is probably blocked on #2808217: To be able to view Vocabulary config entities via REST, one should not have to grant the 'administer taxonomy' permission to set a precedent.

This is definitely not novice in hindsight. Sorry, @Yasiru Nilan!

Add per-bundle "create" permission. The "update" and "delete" cases are less clear. But creating new terms is a very common necessity. Updating/editing and deleting terms is far less common, and is usually an administrator-only task.

This is exactly what #1848686: Add a dedicated permission to access the term overview page (without 'administer taxonomy' permission) did! It did so for all cases: "create", "update" and "delete"! You can see the consequences for the Taxonomy Term REST test coverage in the relevant hunk from that issue:

diff --git a/core/modules/rest/tests/src/Functional/EntityResource/Term/TermResourceTestBase.php b/core/modules/rest/tests/src/Functional/EntityResource/Term/TermResourceTestBase.php
index 44a4e83033..97599774b3 100644
--- a/core/modules/rest/tests/src/Functional/EntityResource/Term/TermResourceTestBase.php
+++ b/core/modules/rest/tests/src/Functional/EntityResource/Term/TermResourceTestBase.php
@@ -41,16 +41,23 @@ protected function setUpAuthorization($method) {
       case 'GET':
         $this->grantPermissionsToTestedRole(['access content']);
         break;
+
       case 'POST':
+        $this->grantPermissionsToTestedRole(['create terms in camelids']);
+        break;
+
       case 'PATCH':
-      case 'DELETE':
         // Grant the 'create url aliases' permission to test the case when
         // the path field is accessible, see
         // \Drupal\Tests\rest\Functional\EntityResource\Node\NodeResourceTestBase
         // for a negative test.
-        // @todo Update once https://www.drupal.org/node/2824408 lands.
-        $this->grantPermissionsToTestedRole(['administer taxonomy', 'create url aliases']);
+        $this->grantPermissionsToTestedRole(['edit terms in camelids', 'create url aliases']);
         break;
+
+      case 'DELETE':
+        $this->grantPermissionsToTestedRole(['delete terms in camelids']);
+        break;
+
     }
   }
 

🎉