Simplify permissions

[seth-shaw-unlv]

While attempting to add Islandora Workbench to an existing site with ratcheted down permissions I discovered that I had to grant the user's role several permissions they didn't previously have, some with security implications. They are listed below with the Permissions page label, the machine name in parentheses, and in some cases, the specific routes they apply to.

• Administer site configuration (administer site configuration)
• Content: Administer form display (administer node form display): /entity/entity_form_display/node.dc_object.default?_format=json
• Content: Administer fields (administer node fields): /entity/field_config/node.dc_object.body?_format=json
• Administer vocabularies and terms (administer taxonomy): /term_from_uri?_format=json&uri=... & /term_from_authority_link?_format=json&authority_link=...
• Taxonomy term: Administer form display (administer taxonomy_term form display): /entity/entity_form_display/taxonomy_term.digital_projects.default?_format=json
• Taxonomy term: Administer fields (administer taxonomy_term fields): /entity/field_config/taxonomy_term.digital_projects.field_project_alias?_format=json
• Administer media types (administer media types)
• Administer content types (administer nodes)

[mjordan]

@seth-shaw-unlv do we need to change anything in the module to resolve this or is this just a documentation issue?

[mjordan]

Answering my own question here... maybe this module should provide a custom permission for the routes in islandora_workbench_integration.routing.yml to avoid giving users the high-level "administer site configuration" permission. Also, it is possible to export the config for a role, so we could add a pre-configured role to this module to package up all the required permissions.