Issue #3605834: Move process instances to Structure, add a canonical link and a per-tenant access permission

Frank Mablyrequested to merge
issue/orchestra-3605834:3605834-instances-structure into 1.x

Implements [#3605834].

Problem

Process instances are runtime data, not workflow configuration, yet the instance UI lived under Configuration > Workflow next to the definitions, and every instance route required the same administer orchestra permission as editing the configuration.

What changes

  • The instance list and detail move to /admin/structure/orchestra/instances, under a new Structure > Orchestra menu group.
  • The detail route is renamed to the entity-canonical convention entity.orchestra_instance.canonical; orchestra_ui declares the canonical link template on the instance via hook_entity_type_alter, so toUrl() works wherever the UI is installed and resolves through the route system (surviving an admin-path rename). The entity stays UI-agnostic.
  • A new access orchestra instances permission gates the list, detail and drive operations (signal, fire timer, run), distinct from administer orchestra. Both grant access, so administrators keep their reach.
  • A tenant access check confines a scoped operator to the current tenant on the id-bearing routes (mirroring the incident access check), and the list query is scoped to the current tenant for a non-administrator, so the delete selection cannot reach another tenant.

Tests

Adds a unit test for the tenant access check (instance and token) and updates the functional tests to the new paths. Verified locally: orchestra_ui functional (4) + kernel (4) + the new unit test (5) all pass.

Merge request reports