Problem/Motivation

OgMenuInstance declares admin_permission: 'administer OgMenuInstance entities', but that permission is not defined in og_menu.permissions.yml and cannot be granted to a role.

It has no effect today because OgMenuInstanceAccessControlHandler fully handles access without deferring to the parent implementation. However, the entity definition is misleading and could become significant if the handler later relies on the base access checks.

Proposed resolution

Remove admin_permission from the entity definition. Access is already handled entirely by the custom access control handler, including the site-wide administer og menu bypass.

Remaining tasks

  • Remove admin_permission from the attribute and legacy annotation.
  • Verify OgMenuInstanceAccessTest still passes.

Issue fork og_menu-3624498

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

joelpittet created an issue. See original summary.

joelpittet opened merge request !32

joelpittet’s picture

joelpittet
he/him
Primary language English
Location Vancouver
commented
Status: Active » Fixed

Merged into 2.x.

One note for the record: the summary says the undefined permission had no effect, which is almost true. The only code path that read it was JSON:API's hook_jsonapi_entity_filter_access(), which called allowedIfHasPermission() for a permission no user could hold. Filtering "among all" was therefore never granted, so removing the permission produces the same result.

The other potential consumers were already unreachable: OgMenuInstanceAccessControlHandler overrides checkAccess() and checkCreateAccess() without calling the parent, and the entity has no collection link for DefaultHtmlRouteProvider to expose.

I deliberately did not replace it with administer og menu, as OgMenu does. That would grant JSON:API filter access to site administrators, which is a real behaviour change and should have its own issue and test if desired.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • joelpittet committed 60251892 on 2.x 
    task: #3624498 Remove undefined admin_permission from OgMenuInstance