fix: #3636840 Routes require a permission that does not exist

Thomas Alsénrequested to merge
issue/earkiv-3636840:3636840-routes-require-a into 1.0.x

Closes https://www.drupal.org/project/earkiv/issues/3636840

Cause

All routes required administer earkiv_archive entity, which the module does not define. The defined permission is administer earkiv entities, the admin_permission of both entity types. Only user 1 and administrator roles could use the module, while users with the defined permission got 403 on every page but could still download the archive files.

What it does

  • The settings page and the archive and schedule lists require administer earkiv entities.
  • The add and delete forms use _entity_create_access and _entity_access, so they follow the access handler of the entity types.
  • The menu link of the settings page moves from Content authoring to Web services (system.admin_config_services), where the page is (/admin/config/services/earkiv).

Testing

With a user that has only "Administer E-Arkiv entities" and a user without it:

Page With the permission Without
/admin/config/services/earkiv 200 403
/admin/content/earkiv 200 403
/earkiv/archive/add 200 403
/earkiv/archive/{id}/delete 200 403
/admin/content/earkiv/schedules 200 403
/earkiv/schedule/add 200 403
Archive file download 200 403

The schedule delete form uses the same check as the archive delete form; there were no schedules to test it with.

AI-Generated: Yes (Used Claude Code to find the cause, write the fix and write this merge request.)

Merge request reports