Security model and menu access

Question

Drupal 8.6.1

I have some menu items I would like to hide from some users: An administration menu with documentation about site admin; A contributors menu with documentation for contributors. etc.

It appears that Drupal prefers every menu entry to link to something. I have these menus pointing to route:<nolink> and have the content hanging from them, tagged as required to implement https://www.drupal.org/project/permissions_by_term.

The result of this is that the top level menu items are visible to everyone.

Is the Drupal philosophy to create some content/view and assign permissions to that for these top-level menus?

Answer 1

Is the Drupal philosophy to create some content/view and assign permissions to that for these top-level menus?

Obviously there is no hard and fast rule about this, but generally speaking your hunch is correct. Drupal menus expect every link (even a parent) to link to some content. As an example, the "add content" link goes to a page that lists the available content types even though the content types are usually listed under "add content" in the menu anyway.

I do not believe there is an example in core where a menu link is there only as a parent and does not link anywhere.

Answer 2

route:<nolink> is relatively new in core (since 8.2) but also what would you rely on to check access for an item that doesn't go anywhere?

You can manually assign menu item permissions through Menu Item Role Access.

Or create your links lists through Views (Block Display). There you can assign Access by Role or existing Permission. That may be the most flexible solution if you are able to filter out your target content this way.