Issue #3066645 by e0ipso: Add more granular permissions

api_proxy.permissions.yml

-use api proxies:
-  title: 'Use the API proxies'
+administer api proxies:
+  title: 'Administer the API proxies'
+
+permission_callbacks:
+  - Drupal\api_proxy\ApiProxyPermissions::permissions

src/ApiProxyPermissions.php

+<?php
+
+namespace Drupal\api_proxy;
+
+use Drupal\api_proxy\Plugin\HttpApiInterface;
+use Drupal\api_proxy\Plugin\HttpApiPluginManager;
+use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Provides API Proxy module permissions.
+ */
+final class ApiProxyPermissions implements ContainerInjectionInterface {
+
+  /**
+   * The API Proxy resource plugin manager.
+   *
+   * @var \Drupal\api_proxy\Plugin\HttpApiPluginManager
+   */
+  private $proxyPluginManager;
+
+  /**
+   * Constructs a new ApiProxyPermissions instance.
+   *
+   * @param \Drupal\api_proxy\Plugin\HttpApiPluginManager $proxy_plugin_manager
+   *   The HTTP API proxy plugin manager.
+   */
+  public function __construct(HttpApiPluginManager $proxy_plugin_manager) {
+    $this->proxyPluginManager = $proxy_plugin_manager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static($container->get(HttpApiPluginManager::class));
+  }
+
+  /**
+   * Returns an array of API Proxy permissions.
+   *
+   * @return array
+   *   The permissions structured array.
+   */
+  public function permissions() {
+    return array_reduce(
+      $this->proxyPluginManager->getHttpApis(),
+      function ($permissions, HttpApiInterface $proxy) {
+        return array_merge($permissions, $proxy->permissions());
+      },
+      []
+    );
+  }
+
+}

src/Plugin/HttpApiInterface.php

@@ -34,4 +34,19 @@ interface HttpApiInterface {
    */
   public function addMoreConfigurationFormElements(array $form, SubformStateInterface $form_state): array;
 
+  /**
+   * Provides an array of permissions suitable for .permissions.yml files.
+   *
+   * A resource plugin can define a set of user permissions that are used on the
+   * routes for this resource or for other purposes.
+   *
+   * It is not required for a resource plugin to specify permissions: if they
+   * have their own access control mechanism, they can use that, and return the
+   * empty array.
+   *
+   * @return array
+   *   The permission array.
+   */
+  public function permissions();
+
 }

src/Plugin/HttpApiPluginBase.php

@@ -2,7 +2,6 @@
 
 namespace Drupal\api_proxy\Plugin;
 
-use Drupal\api_proxy\Controller\Forwarder;
 use Drupal\Component\Plugin\ConfigurablePluginInterface;
 use Drupal\Component\Utility\Crypt;
 use Drupal\Component\Utility\UrlHelper;
@@ -22,7 +21,6 @@ use Symfony\Component\HttpFoundation\HeaderBag;
 use Symfony\Component\HttpFoundation\ParameterBag;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
-use Symfony\Component\HttpKernel\Exception\HttpException;
 
 /**
  * Base class for HTTP API plugins that implement settings forms.
@@ -437,4 +435,16 @@ abstract class HttpApiPluginBase extends PluginBase implements ContainerFactoryP
     }, FALSE);
   }
 
+  /**
+   * {@inheritdoc}
+   */
+  public function permissions() {
+    $permission = sprintf('use %s api proxy', $this->getPluginId());
+    $definition = $this->getPluginDefinition();
+    $title = $this->t('Use the HTTP API proxy for %label', [
+      '%label' => $definition['label']
+    ]);
+    return [$permission => ['title' => $title]];
+  }
+
 }