The routes in `streaming_media_views.routing.yml` require:
_permission: 'Administer media'
However, Drupal’s permission machine name is lowercase:
_permission: 'administer media'
Permission checks are case-sensitive. Consequently, granting the standard “Administer media” permission does not give non-administrator users access to these routes:
- streaming.transcode
- streaming.refresh
- streaming.clear
- streaming.delete
Steps to reproduce:
- Grant a non-administrator role the standard `administer media` permission.
- Assign that role to a user.
- As that user, open the transcode page for a Streaming video media item.
Actual result: Access denied.
Expected result: Users granted the required permission can access the operation.
Manually adding the uppercase `Administer media` string to the role configuration allows access, confirming the mismatch. However, this is not a durable workaround: Drupal removes undeclared permissions when recalculating a role’s dependencies during a normal role save.
Suggested fix: Replace `Administer media` with `administer media` in all four route requirements. Alternatively, declare dedicated permissions for streaming operations to avoid requiring broad media administration privileges.
Verified on Drupal 10.6.21.
Comments