Add initial code

block_region_permissions.info.yml

+name: Block Region Permissions
+description: "Adds specific permissions for administering blocks for each theme's regions."
+package: Block
+type: module
+version: '1.0'
+core: 8.x

block_region_permissions.module

+<?php
+
+/**
+ * @file
+ * Block region permissions module.
+ */
+
+use \Drupal\Core\Render\Element;
+use \Drupal\block\Entity\Block;
+use \Drupal\Core\Form\FormStateInterface;
+use \Drupal\Core\Session\AccountInterface;
+use \Drupal\Core\Access\AccessResult;
+
+/**
+ * Implements hook_form_FORM_ID_alter().
+ */
+function block_region_permissions_form_block_admin_display_form_alter(&$form, FormStateInterface $form_state, $form_id) {
+  // Get theme name.
+  $current_path = \Drupal::service('path.current')->getPath();
+  if ($current_path == '/admin/structure/block') {
+    // Get default theme.
+    $theme_key = \Drupal::config('system.theme')->get('default');
+  } else {
+    // Get theme from path.
+    $theme_key = str_replace('/admin/structure/block/list/', '', $current_path);
+  }
+
+  // Get block keys for each region.
+  // Also get a master list of region select field options.
+  $region_block_keys = array();
+  $region_options = array();
+  $block_elements = Element::children($form['blocks']);
+  foreach ($block_elements as $block_key) {
+    // Get region name.
+    $region_key = '';
+    if (substr($block_key, 0, 7) == 'region-') {
+      // Region label or message.
+      list(,$region_key,) = explode('-', $block_key);
+    } elseif (substr($block_key, 0, 7) != 'region-' && $block = Block::load($block_key)) {
+      // Region block.
+      $region_key = $block->getRegion();
+      // Save master list of options one time.
+      if (empty($region_options)) {
+        $region_options = $form['blocks'][$block_key]['region-theme']['region']['#options'];
+      }
+    }
+    // Save region names with block keys.
+    if (!empty($region_key)) {
+      if ($region_key == -1) {
+        $region_key = 'disabled';
+      }
+      $region_block_keys[$region_key][] = $block_key;
+    }
+  }
+
+  // Remove blocks for regions the user cannot administer. 
+  foreach ($region_block_keys as $region_key => $block_keys) {
+    if ($region_key != 'disabled') {
+      if (!\Drupal::currentUser()->hasPermission("administer $theme_key $region_key")) {
+        // Remove block.
+        foreach ($block_keys as $key => $block_key) {
+          unset($form['blocks'][$block_key]);
+        }
+        // Update tracking.
+        unset($region_block_keys[$region_key]);
+      }
+    }
+  }
+
+  // Remove region select field options for regions the user cannot
+  // administer.
+  if (!empty($region_block_keys)) {
+    // Remove options from master list.
+    foreach ($region_options as $region_key => $options) {
+      if (!\Drupal::currentUser()->hasPermission("administer $theme_key $region_key")) {
+        unset($region_options[$region_key]);
+      }
+    }
+    // Replace form block options with master list.
+    foreach ($region_block_keys as $region_key => $block_keys) {
+      foreach ($block_keys as $block_key) {
+        if (isset($form['blocks'][$block_key]['region-theme']['region']['#options'])) {
+          $form['blocks'][$block_key]['region-theme']['region']['#options'] = $region_options;
+        }
+      }
+    }
+  }
+}
+
+/**
+ * Implements hook_form_FORM_ID_alter().
+ */
+function block_region_permissions_form_block_form_alter(&$form, FormStateInterface $form_state, $form_id) {
+  // Get theme name.
+  $theme_key = $form['theme']['#value'];
+
+  // Remove region select field if the user cannot administer for the selected
+  // region.
+  $region_key_default = $form['region']['#default_value'];
+  if ($region_key_default != -1 && !\Drupal::currentUser()->hasPermission("administer $theme_key $region_key_default")) {
+    unset($form['region']);
+    return;
+  }
+
+  // Remove region select field options for regions the user cannot
+  // administer.
+  $region_options = $form['region']['#options'];
+  foreach ($region_options as $region_key => $options) {
+    if (!\Drupal::currentUser()->hasPermission("administer $theme_key $region_key")) {
+      unset($form['region']['#options'][$region_key]);
+    }
+  }
+}
+
+/**
+ * Implements hook_block_access().
+ */
+function block_region_permissions_block_access(Block $block, $operation, AccountInterface $account) {
+  // Disallow delete and update permissions if the user cannot administer for
+  // the selected region.
+  switch ($operation) {
+    case 'delete':
+    case 'update':
+      $theme_key = $block->getTheme();
+      $region_key = $block->getRegion();
+      if ($region_key != -1) { // Skip disabled/none
+        return AccessResult::forbiddenIf(!\Drupal::currentUser()->hasPermission("administer $theme_key $region_key"));
+      }
+  }
+}

block_region_permissions.permissions.yml

+permission_callbacks:
+  - Drupal\block_region_permissions\BlockRegionPermissionsPermissions::permissions

src/BlockRegionPermissionsPermissions.php

+<?php
+
+namespace Drupal\block_region_permissions;
+
+use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
+use Drupal\Core\Extension\ThemeHandlerInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+
+/**
+ * Provides dynamic permissions for the block region permissions module.
+ */
+class BlockRegionPermissionsPermissions implements ContainerInjectionInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * The entity manager.
+   *
+   * @var \Drupal\Core\Extension\ThemeHandlerInterface
+   */
+  protected $themeHandler;
+
+  /**
+   * Constructs a new BlockRegionPermissionsPermissions instance.
+   *
+   * @param \Drupal\Core\Extension\ThemeHandlerInterface $theme_handler
+   *   The theme handler.
+   */
+  public function __construct(ThemeHandlerInterface $theme_handler) {
+    $this->themeHandler = $theme_handler;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('theme_handler')
+    );
+  }
+
+  /**
+   * Return the permissions for the block region permissions.
+   *
+   * @return array
+   *   Array of permissions.
+   */
+  public function permissions() {
+    $permissions = [];
+
+    // Get themes and generate permissions for each theme's regions.
+    $themes = $this->themeHandler->listInfo();
+    foreach ($themes as $theme_key => $theme) {
+      if ($theme->status == 1 && (!isset($theme->info['hidden']) || $theme->info['hidden'] != 1)) {
+        $theme_name = $theme->info['name'];
+        // Get regions for this theme.
+        $regions = $theme->info['regions'];
+        // Add permissions for each region
+        foreach ($regions as $region_key => $region_name) {
+          $permissions["administer $theme_key $region_key"] = [
+            'title' => $this->t('Administer: <em>@theme</em> - <em>@region</em>', ['@theme' => $theme_name, '@region' => $region_name]),
+          ];
+        }
+      }
+    }
+    return $permissions;
+  }
+
+}