Problem/Motivation
We currently allow entities to specify an "admin permission". Entity types such as Node and others provide a separate "overview" permission that is useful for granting people access the entity view, even if they do not have the admin permission. For example you may want to allow some people to edit entities, but not delete them or people may have access to edit and delete some entities but not others. In such cases it's necessary to access the entity overview but not have the admin permission.
Proposed resolution
- Allow entities to provide a "collection permission" in addition to the admin permission. ("collection" is chosen as a term instead of "overview" to comply with the collection link template and route.) Just like the admin permission the actual name of the permission (i.e. "access $foo overview") is determined by an annotation key.
- Update the generated collection route to allow access to either the admin permission or the collection permission.