Problem/Motivation

As @Berdir mentioned here #6

I think we should also investigate this real item count stuff together with access.

I find that highly confusing, as I said before, If there are 3 texts and a text + item (which I do not have access to) on a field that allows 4 values then the one I don't have access to will be removed and I will be allowed to add a nother one?

IMHO, we need an access_denied state, that displays a message that you can't edit a paragraph. Similar to closed, but can't be opened.

Proposed resolution

I tested this with @Berdir and we deal that everything is working nice, and we only need test coverage

Remaining tasks

User interface changes

API changes

Data model changes

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

toncic created an issue. See original summary.

miro_dietiker’s picture

Priority: Normal » Major

Advanced access is challenging.

If a user has view permission on a paragraph but not edit, we can easily indicate each unediable paragraph just with the collapsed summary.
If a user wouldn't even be allowed to view a paragraph, then we have a problem.

For advanced content building, those things are very important.
We can place functional paragraphs (such as a view) and lock them down. The editor can then only edit the regular content fields.
This case needs more investigation combined with library, templates, and other cases.
In some projects, we had limitations about strict positioning. Thus, we would need not only lock editing of the paragraphs, but also make it non-drag-and-drop'able. It's hard to design something that works clean and easily with these requirements.

Mind that we have our Paragraphs Access plugin as a starting point.
We will need this to limit error in our future installation. Might need multiple dedicated issues.

Berdir’s picture

Category: Task » Bug report

Yeah, but things like preventing drag & drop is pretty advanced and IMHO new features. If I'm correct then this is a bug and a pretty serious one.

toncic’s picture

Assigned: Unassigned » toncic
Category: Bug report » Task
Priority: Major » Normal
Status: Active » Needs review
Issue tags: +Needs tests
FileSize
1.76 KB

I tested this with @Berdir and we deal that everything is working nice, and we only need test coverage.
So I wrote test to check what is happening when we are access the edit page when we don't have admin permission.

johnchque’s picture

Status: Needs review » Needs work
  1. +++ b/modules/paragraphs_type_permissions/src/Tests/ParagraphsTypePermissionsTest.php
    @@ -170,6 +170,15 @@ class ParagraphsTypePermissionsTest extends WebTestBase {
    +    //Check the authenticated user with edit permission.
    

    Missing space between "//" and "Check".

  2. +++ b/src/Plugin/Field/FieldWidget/InlineParagraphsWidget.php
    @@ -629,6 +629,9 @@ class InlineParagraphsWidget extends WidgetBase {
    +      // Access for the top element is set to FALSE only when the paragraphs
    +      // was removed.
    +      // A paragraphs that user can not edit has access on lover level.
    

    Let's use Paragraph instead of Paragraphs, otherwise "Paragraphs was" doesn't really make sense. Also don't create a new line after "." Continue the comment in the same line.

toncic’s picture

Status: Needs work » Needs review
FileSize
1.75 KB
1.71 KB

Implementing comm #5.

toncic’s picture

Berdir’s picture

Title: Add new access_denied state » Add tests for per-type access checking
Status: Needs review » Needs work
Issue tags: -Needs tests
  1. +++ b/modules/paragraphs_type_permissions/src/Tests/ParagraphsTypePermissionsTest.php
    @@ -170,6 +170,15 @@ class ParagraphsTypePermissionsTest extends WebTestBase {
    +    $this->drupalGet('node/' . $node->id() . '/edit');
    +    $this->assertRaw('Image + Text');
    +    $this->assertText('You are not allowed to edit or remove this Paragraph.');
    

    We can do a bit better I think.

    We should make sure that we can see the content of the image + text field, and that we can see the add button for image + text but not the one for the other type we don't have access to.

  2. +++ b/src/Plugin/Field/FieldWidget/InlineParagraphsWidget.php
    @@ -629,6 +629,8 @@ class InlineParagraphsWidget extends WidgetBase {
    +      // removed. A paragraphs that user can not edit has access on lover level.
    

    that *a* user

    lover level? what is that exactly? ;)

    also, this is supposed to comment the part where we decrement real item count

johnchque’s picture

Isn't this accomplished by the sub module "paragraphs type permissions"?

Berdir’s picture

Yes, we are just adding explizit tests and better because the current logic is very non-intuitive.

toncic’s picture

Implementing comm #8.

miro_dietiker’s picture

Status: Needs review » Needs work

The tests don't correspond to the issue summary.

Are we now trying to improve / overhaul the real item count or other internal counters?
We didn't add any access denied state.
And i guess we need a paragraph field with count limitation and make sure a user without access to one of the paragraphs is able to add one more.
And Berdir said that saving a host entity without access to a paragraph results in deletion of the items.
Lots of things to check and cover. :-)

Berdir’s picture

I tested this with @Berdir and we deal that everything is working nice, and we only need test coverage.

deal => confirmed ;)

But yes, issue summary needs to be updated.

toncic’s picture

Issue summary: View changes
Status: Needs work » Needs review

Issue summary updated.

  • miro_dietiker committed 31ffa2b on 8.x-1.x authored by toncic
    Issue #2834829 by toncic, Berdir: Add tests for per-type access checking
    
miro_dietiker’s picture

Status: Needs review » Fixed

And we have some better tests of the access thingy! Committed! :-)

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.