Open seth-shaw-unlv opened 2 years ago
@seth-shaw-unlv do we need to change anything in the module to resolve this or is this just a documentation issue?
Answering my own question here... maybe this module should provide a custom permission for the routes in islandora_workbench_integration.routing.yml to avoid giving users the high-level "administer site configuration" permission. Also, it is possible to export the config for a role, so we could add a pre-configured role to this module to package up all the required permissions.
While attempting to add Islandora Workbench to an existing site with ratcheted down permissions I discovered that I had to grant the user's role several permissions they didn't previously have, some with security implications. They are listed below with the Permissions page label, the machine name in parentheses, and in some cases, the specific routes they apply to.
/entity/entity_form_display/node.dc_object.default?_format=json
/entity/field_config/node.dc_object.body?_format=json
/term_from_uri?_format=json&uri=...
&/term_from_authority_link?_format=json&authority_link=...
/entity/entity_form_display/taxonomy_term.digital_projects.default?_format=json
/entity/field_config/taxonomy_term.digital_projects.field_project_alias?_format=json