#3523397: Make adding students to classes access mapped by course permission.

Closes #3523397

src/Access/ClassPermissionCalculator.php

@@ -9,6 +9,7 @@ use Drupal\Core\Session\AccountInterface;
 use Drupal\flexible_permissions\CalculatedPermissionsItem;
 use Drupal\flexible_permissions\PermissionCalculatorBase;
 use Drupal\flexible_permissions\RefinableCalculatedPermissionsInterface;
+use Drupal\group\Entity\GroupMembershipInterface;
 use Drupal\group\Entity\GroupRelationshipInterface;
 use Drupal\group\PermissionScopeInterface;
 use Drupal\lms\Entity\Bundle\Course;
@@ -51,9 +52,18 @@ final class ClassPermissionCalculator extends PermissionCalculatorBase {
     foreach ($memberships as $membership) {
       $calculated_permissions->addCacheableDependency($membership);
 
-      \assert($membership instanceof GroupRelationshipInterface);
+      \assert($membership instanceof GroupMembershipInterface);
       $course = $membership->getGroup();
       \assert($course instanceof Course);
+
+      $class_permissions = ['view group'];
+      foreach ($membership->getRoles(TRUE) as $role) {
+        $calculated_permissions->addCacheableDependency($role);
+        if ($role->hasPermission('add students')) {
+          $class_permissions[] = 'administer members';
+        }
+      }
+
       foreach ($course->getClasses() as $class) {
         $class_id = $class->id();
         if (\array_key_exists($class_id, $class_ids)) {
@@ -64,10 +74,7 @@ final class ClassPermissionCalculator extends PermissionCalculatorBase {
         $calculated_permissions->addItem(new CalculatedPermissionsItem(
           $scope,
           $class_id,
-          [
-            'administer members',
-            'view group',
-          ],
+          $class_permissions,
           FALSE,
         ));
       }
@@ -83,7 +90,7 @@ final class ClassPermissionCalculator extends PermissionCalculatorBase {
     $courses = [];
 
     foreach ($memberships as $membership) {
-      \assert($membership instanceof GroupRelationshipInterface);
+      \assert($membership instanceof GroupMembershipInterface);
       $course_relationships = $this->entityTypeManager->getStorage('group_relationship')->loadByProperties([
         'plugin_id' => 'lms_classes',
         'entity_id' => $membership->getGroupId(),