Add filter option to UserSelection to exclude blocked users

Looking at the patch, it is likely implemented in the reverse. The default behaviour is to exclude blocked, so the option should probably be "Include blocked".

Tackling test failures, and there is a HTML issue with the form field not closing its <em> tag.

• Tests added.
• Fixed HTML for checkbox.
• Added schema for entity reference selection plugin settings
• Inverted text to be "include blocked", since the current and default behaviour is to exclude blocked.

Interdiff with #2

The initial intent was to allow fields to be configured such that even admins cannot reference blocked accounts...

Reading your patch, it seemed you wanted to retain the existing behaviour somewhat, because the >hasPermission('administer users') snippet was still present.

even admins cannot reference blocked

If this patch is a binary yes/no you can/t reference blocked users then this would be a behaviour change.

The current behaviour could be retained by having the radio preference:

• Allow users with administer users to reference blocked users. (default)
• Allow anyone to reference blocked users.
• Reference blocked users is prohibited.

This issue is confusing

I see the intent of the original patch was to make it so blocked users would always be excluded, regardless of permission. But then this does not cover situations where you want non-admin to reference blocked.

admin = user with `administer permissions`

All these multiple binary/negating conditions are confusing, these are the options I see are available.

Option A

Proposed by this issue.

• UI: options are (boolean, checkbox, 2-states)
  • FALSE: Admin can reference blocked users (default)
  • TRUE: Admin cannot reference blocked users.
• Effect:
  • admin can sometimes reference blocked users
  • non-admin can never reference blocked users

Option B

• UI: options are (radio, 3-states)
  • 0: Only admin can reference blocked (default)
  • -1: Nobody can reference blocked
  • 1: Anybody can reference blocked
• Effect:
  • Sometimes no-one can reference blocked users.
  • Sometimes only admins can reference blocked users.
  • Sometimes everyone can reference blocked users.

Option C

Proposed by #6

• UI: options are (boolean, checkbox, 2-states)
  • FALSE: Non-admin cannot reference blocked users (default)
  • TRUE: Non-admin can reference blocked users
• Effect:
  • Admin can always view blocked users.
  • Non-admin can sometimes reference blocked users.

Submitting a patch based on option A as proposed by this issue.

Patch did not apply so cudnt get an interdiff

1. Test path has changed, so made changes in the new file. Added one more assertion based on the use cases.
2. Ported patch to 8.5.

Hmm, I think the included test is giving a false positive (i.e. it's not actually testing what it needs to) because $handler_settings was refactored to $configuration at some point and so this patch no longer works the way it's supposed to.

I've made a number of modifications to the last patch:

1. Rerolled to work with 8.6
2. Removed redundant test cases.
3. Fixed new test case, which was not hitting any assertions due to missing arguments in $referenceable_tests.
4. Added #states to the "Include anonymous" field to make it clear that if you exclude blocked users, you won't get the anonymous user either.
5. Changed default setting for include_blocked to TRUE, as that is how it functions prior to this feature and we don't want unexpected behavior to be introduced.
6. For a slight performance improvement, the include_blocked check is now performed before checking for the administer users permission, which is more expensive.

Looks like some random testbot issue caused those failures, so retry.

The referenced users are validated in \Drupal\user\Plugin\EntityReferenceSelection\UserSelection::validateReferenceableNewEntities(). This method still validates the user is active based on the permission 'administer users':

if (!$this->currentUser->hasPermission('administer users')) {
  $entities = array_filter($entities, function ($user) {
    /** @var \Drupal\user\UserInterface $user */
    return $user->isActive();
  });
}

This means this patch needs at least two changes:

1. The validation method \Drupal\user\Plugin\EntityReferenceSelection\UserSelection::validateReferenceableNewEntities() needs to be updated to allow for the configuration option 'include blocked'.
2. The test coverage needs to be extended so it actually saves a reference to a blocked user through a form, so it passes all the relevant form validations.

This is also related to #2836245: Unable to reference blocked user on node save in that users that don't have the "Administer users" permission are unable to submit the edit form for nodes created by a now blocked user. Editing a node should not require you to alter the history about who created it.

IMO user reference fields should default to allowing all users, unless overridden with the configuration in the attached patch.

Disregard #25. It looks like that particular bug is fixed in #2791269: Allow saving pre-existing references to inaccessible items