Entity forms bypass the access handler

Question

My entity defines an access control handler (a subclass of \Drupal\Core\Entity\AccessControlHandlerInterface) as well as a delete form (a subclass of \Drupal\Core\Entity\EntityConfirmFormBase).

The access handler designates certain entities as uneditable, and returns \Drupal\Core\Access\AccessResult::forbidden() on the "update" and "delete" operations for those entities.

This has the correct effect of hiding the "Edit" and "Delete" operation from the entity list.

Unfortunately, it doesn't do the same when visiting the forms directly via their URLs.

What am I doing wrong here? How do I actually block access to the forms?

Edit: The 404 was because I had the wrong URL for the edit form; turns out it's actually for all operations.

Do I need to call $this->entity->access($this->operation) myself in buildForm()?

Answer 1

In your delete route add _entity_access: yourentity.delete to the route requirements.

As Ivan pointed out in the comment, this is a matter of the route not automatically requiring entity access when it points at an entity form. The entity access requirement must be added to the route explicitly.