Local task for content node doesn't show up and raises 'Access denied'

Question

After spending two days trying to figure this out, it's probably better to ask for help.

I need to add a custom tab next to View Edit Delete Revisions Translate for content nodes (a local task, if I understand the terminology correctly). This tab is supposed to open a form where the user can select from a choice of tasks to perform on the current node (e.g. generating a summary of the text with A.I.).

I have already successfully added another tab that opens a View (/admin/content/query/%). It works fine:

MODULE_NAME.routing.yml

# This works fine
MODULE_NAME.manage_content:
  path: '/admin/content/query/{node}'
  requirements:
    _role: 'administrator, content_editor'
  options:
    parameters:
      node:
        type: 'entity:node'

MODULE_NAME.link.tasks.yml

# This works fine
MODULE_NAME.manage_content:
  route_name: 'MODULE_NAME.manage_content'
  title: 'Manage'
  base_route: entity.node.canonical
  weight: 200

I just can't get it to work for the new tab (it doesn't even show up), which is supposed to open a Form:

MODULE_NAME.routing.yml

# This won't work no matter what 
MODULE_NAME.node_options:
  path: '/node/{node}/options'
  defaults:
    _form: '\Drupal\MODULE_NAME\Form\ConfirmOptionsForm'
  requirements:
    _role: 'administrator, content_editor'
  options:
    parameters:
      node:
        type: 'entity:node'

MODULE_NAME.link.tasks.yml

# This won't work no matter what 
MODULE_NAME.node_options:
  route_name: 'MODULE_NAME.node_options'
  title: 'Options'
  base_route: entity.node.canonical  
  weight: 210

ConfirmOptionsForm is a subclass of ConfirmFormBase.

When I call /node/1234/options manually with a web browser, Drupal shows an 'Access denied' error (You are not authorized to access this page). This suggests the path is somehow off limits, but how? Trying other paths didn't help.

What am I missing?

Answer 1

One thing to note is that with _role: 'administrator,content_editor' the route is accessible to users who have both the roles, not either one or the other role.

As described in Structure of routes, you can separate the single roles an accounts needs to have to access the route with a + sign. In your case, instead of _role: 'administrator,content_editor', you would use _role: 'administrator+content_editor'. That would make the route accessible to users who have either the administrator or the content editor role.

However, in Drupal, it is preferred to use permissions instead of roles. It allows better flexibility because the permission can be added to more roles without changing the route definition.

This is the first step I would go with.