Get list of webforms that can be created by the current user

Question

Testing Webform in Drupal 8, I've found something strange when trying to get the list of the available webforms that a user can create.

My test environment: I've created a role, a user that belongs to that role and 3 webforms. In the "Access" tab of each of the webforms I've unchecked "Anonymous user" and "Authenticated User" and allowed access only to "Administrator" in 2 of the webforms. In the last one, I gave "create" access to my specific role.

Then, for testing purposes I created a rest service with the following code:

public function get() 
{
    // Load all the available entities
    $entities = \Drupal::entityTypeManager()->getStorage('webform')->loadMultiple(NULL);

    // Check the access of the current user to each of the entities 
    $forms = array();
    foreach( $entities as $entity_id => $entity )
    {
       $forms[] = array( "$entity_id" => $entity->access('create', NULL) );
    }

    return new ModifiedResourceResponse($forms);
}

I expected to get:

[{"webform1":false},{"webform2":false},{"webform3":true}]

But I get:

[{"webform1":false},{"webform2":false},{"webform3":false}]

In fact, I returned the $entity object as JSON and I found that the entity references the following permissions: "create", "view_any", "update_any", "delete_any", "purge_any", "view_own", "update_own", "delete_own". If I expand the tree, then I can see that inside the "create" permission of my webform3 entity, the permissions are properly referenced (Object->access->create->Roles->My Role is present only in the last form).

But the ->access('create') function is always returning false. The same goes for "view_any" and the other permissions. The only permission that returns true for all the forms is "view".

Is there any way that I can do this? :

    $entities = \Drupal::entityTypeManager()->getStorage('webform')->loadMultiple(NULL);
    $forms = array();
    foreach( $entities as $entity_id => $entity )
    {
       if( $entity->access('create', NULL) ) 
       {
           $forms[] = $entityid;
       }
    }
    return new ModifiedResourceResponse($forms);

Thanks and best regards.

Answer 1

I'll autoanswer my question :)

By grep-ing inside Webform source code I found that the permission name is not "create", but "submission_create", even if dpm($entity) is referencing "create".

$ grep -r "access" * | grep submission_create
webform_node.routing.yml:    entity_access: 'webform.submission_create'
Webform.php:                 if (!$webform || !$webform->access('submission_create')) {
(...)

So, this works as expected:

$entities = \Drupal::entityTypeManager()->getStorage('webform')->loadMultiple(NULL);
$forms = array();
foreach( $entities as $entity_id => $entity )
{
    if( $entity->access('submission_create', NULL) ) {
        $forms[] = $entity_id;
    }
}

It returns only the webforms that you are entitled to send submissions to.