My entity defines an access control handler (a subclass of
\Drupal\Core\Entity\AccessControlHandlerInterface) as well as a delete form (a subclass of
The access handler designates certain entities as uneditable, and returns
\Drupal\Core\Access\AccessResult::forbidden() on the "update" and "delete" operations for those entities.
This has the correct effect of hiding the "Edit" and "Delete" operation from the entity list.
Unfortunately, it doesn't do the same when visiting the forms directly via their URLs.
What am I doing wrong here? How do I actually block access to the forms?
Edit: The 404 was because I had the wrong URL for the edit form; turns out it's actually for all operations.
Do I need to call
$this->entity->access($this->operation) myself in