As a follow-up to "Introduced a new way of working with permissions", it is now (once again) possible to alter someone's group permissions. This enables systems such as synchronized roles, per-group permission overrides, etc.
The way the system works is that your total permissions for the whole website are now built once and then cached with the appropriate cacheability metadata. During build time you can alter the permissions a user will get.
In order to do so, you need to declare a tagged service as follows:
group_permission.default_calculator:
class: 'Drupal\group\Access\DefaultGroupPermissionCalculator'
arguments: ['@entity_type.manager', '@group.membership_loader']
tags:
- { name: group_permission_calculator, priority: -100 }
The class should then extend GroupPermissionCalculatorBase and implement any of the following methods:
calculateAnonymousPermissionscalculateOutsiderPermissionscalculateMemberPermissions
Please make sure you provide the correct cacheability metadata that your permission calculations depend on.
Group comes with some examples of calculators: DefaultGroupPermissionCalculator and SynchronizedGroupPermissionCalculator
