Provide a module-specific permissions form

Problem/Motivation

The Permissions form (/admin/people/permissions) is a usability nightmare. With a checkbox for each combination of permission and role, it can be a performance problem as well.

Let's not try to solve the problem all at once, but try to provide an alternative to using the catch-all Permissions form. We already have a version of the form for a single role, such as /admin/people/permissions/anonymous. Let's also provide a version of the form that applies to just a selected list of modules.

The module-specific Permissions form will be useful in at least these situations:

• Target of links from the Extend page (/admin/modules). Currently those links go to the appropriate anchor on the full Permissions form.
• After installing one or more modules, provide a link to a page with just the newly available permissions.
• After adding configuration, such as a content type, that has related permissions, provide a link to the module-specific Permissions form. (follow-up issue)

Proposed resolution

Provide a form at /admin/people/permissions/module/%, where the parameter can be a single module name or a comma-separated list of module names.

Add a custom access checker for the new form. Deny access unless at least one of the requested modules defines at least one permission. This way, code that provides a link to the new form can check access before adding the link.

Provide a link to the new form after enabling one or more modules. This requires changes to both ModulesListForm and ModulesListConfirmForm, so add a trait for code that is shared by those two classes.

Remaining tasks

Add follow-up issues:

• After adding configuration, such as a content type, that has related permissions, provide a link to the module-specific Permissions form. See #2934995: Implement an API and/or UI for more manageable per-bundle permissions.
• Update the help_topics module and implementations of hook_help(). Replace links to /admin/people/permissions#module-module_name with /admin/people/permissions/module/module_name.
• Move more duplicated code from the Modules form and the Confirmation form to the new trait.

User interface changes

Existing links on /admin/modules will go to instances of the new form.

The message after installing a module (or more than one) will include a link to the new form. Here is a screenshot of the message after enabling the Content Moderation and Workflows module:

Here is a screenshot of the form showing permissions for those two modules:

API changes

None

Data model changes

None

Release notes snippet

Site administrators can view and edit permissions for a single module or a list of modules. The Permissions links on the Extend page (/admin/modules) now go to these pages. When a site administrator enables one or more module from the Extend page, and at least one module provides permissions, the confirmation message includes a link to the page for the newly enabled module(s).