Overview
In #3516648: Update `ExperienceBuilderController` to pass current user's XB high-level permissions to the client we added permission flags for config, and in #3516657: Update `ApiContentControllers::list()` to expose available content entity operations in `meta` we added link-rel meta operations for content.
But we need some way to provide permission flags for _creating_ content, as the meta operations require the content to exist already!
Proposed resolution
ExperienceBuilderController needs to:
1. Find all content entities that can use XB
2. For each of them, check 'create' operation requirements, per bundle if bundleable
3. Add the flags on drupalSettings.xb.permissions
3. Provide a UI label too
So, expected end result is something like:
diff --git a/src/Controller/ExperienceBuilderController.php b/src/Controller/ExperienceBuilderController.php
index 6cac6da64..cf0fa6ad2 100644
--- a/src/Controller/ExperienceBuilderController.php
+++ b/src/Controller/ExperienceBuilderController.php
@@ -122,6 +122,11 @@ HTML;
'codeComponents' => $this->currentUser->hasPermission(JavaScriptComponent::ADMIN_PERMISSION),
'contentTemplates' => $this->currentUser->hasPermission(ContentTemplate::ADMIN_PERMISSION),
],
+ 'contentEntityCreateOperations' => [
+ // And of course add the necessary cacheability!
+ 'xb_page' => $has_permission ? '<singular entity label>' : FALSE,
+ // …repeat for all other content entities that have an XB field
+ ],
],
],
// Note: the tokens here are under our control, and this accepts no user
Expand \Drupal\Tests\experience_builder\Kernel\Controller\ExperienceBuilderControllerTest::testControllerExposedPermissions
User interface changes
The UI will be able to check access to show the pertinent operations.
| Comment | File | Size | Author |
|---|---|---|---|
| #12 | 3513566-12-alt.patch | 8.02 KB | wim leers |
Issue fork experience_builder-3529895
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
penyaskitoComment #3
mglamanShould this be postponed on #3498525: [META] Allow Canvas to be used on any content entity type (bundle), as long as it has certain entity type characteristics
Comment #4
penyaskitoI think we should still do this for page + node--article, even if #3498525: [META] Allow Canvas to be used on any content entity type (bundle), as long as it has certain entity type characteristics would definitely need to refactor this.
Comment #5
wim leers#4++
This is a because without this, the following will always be visible:

Secondarily, this hard-blocked #3513566: [later phase] [PP-1] Add generic create entity support (currently just `Page` content entities).
Comment #6
wim leersAdjusted the proposal.
Note that this can assume a single XB field per content entity type+bundle, if that changes in #3526189: Spike: explore merits of one Canvas field per exposed slot in content templates, it'll be up to that issue to tweak the logic introduced here.
Comment #7
penyaskitoComment #9
penyaskito#4 might not be true and this might be future-proof .🎉
Comment #10
wim leersLooks great!
One question, plus needs a follow-up for fixing cacheability.
Already approved 👍
Comment #11
penyaskitoBack to Wim per !1178.
I'm 50% on each option, so your call. The client UI will probably need to check the absence of the key anyway.
Comment #12
wim leersI wanted to merge this, but on a final pass I'm afraid that the proposal was too incomplete after my adjustment in #6. 😅
The MR lets the XB UI know which content entities can be created, and what the label for that should be. But … it doesn't let you know where that is! 😅So: this should AFAICT:use\Drupal\experience_builder\Resource\XbResourceLinkCollectionpoint toexperience_builder.api.content.create(So: much like\Drupal\experience_builder\Controller\ApiContentControllers::getEntityOperations().)This would then also immediately give us a nice way to pass the cacheability to make #3531858: CanvasController's response must vary by access result cacheability tighter scoped; otherwise that would have to go and modify the method this had just added.Nope, that's because XB controls the "create entity" route:
experience_builder.api.content.create— which is why simple booleans suffice, and the XB UI can then call itscontentApi.createContent.Attaching the patch that I had written locally, but which fails on the way it tries to pass the label via
XbResourceLink's target attributes, because it's a translatable string, not a plain string.Comment #14
wim leersMerged :)
This unblocked #3513566: [later phase] [PP-1] Add generic create entity support (currently just `Page` content entities), and increased the need for #3531858: CanvasController's response must vary by access result cacheability.
Comment #15
jessebaker commentedI'm slightly too late to the party but I've just merged in upstream changes over at #3516641: Make the XB UI show only UI elements/operations available to the current user and the shape of the permissions object is now more complex as a result of this and as a result is going to make the FE code more complex to work around it.
Previously xb.permissions was a simple
This made it easy for the FE to quickly assert if a user had or did not have a given permission by simply checking that list of booleans.
Can this new
contentEntityCreateOperationsobject be moved into the root ofdrupalSettings.xbinstead of inside thepermissionsobject?Comment #16
wim leers#15: or … what about going from this which was merged:
to
?
(Casting that string to a boolean is trivial.)
Comment #17
jessebaker commentedI think the format of contentEntityCreateOperations which was merged is more useful because it's easy to iterate over to build the list of "New x" buttons in the UI. Your proposal in #16 means, to build the list of "New x" buttons, I would have to iterate over the permissions object, filter to just keys that starts with 'create:' and then split the key by : to get the entity type and bundle info.
Maybe there is some value to having the permissions listed in the permissions object as you propose, but I think only if that was in addition to still having the info in the original format elsewhere e.g.
drupalSettings.xb.contentEntityCreateOperationsComment #19
penyaskitoFollow-up MR moving the contentEntityCreateOperations outside of xb.permissions
Comment #21
wim leers