Add Group support to Webform access controls

Problem/Motivation

The Groups module only works on content entities and not config entities. Webforms are config entities while webform nodes are content entities. Individual groups need a mechanism to control group role access to a group's webform (content) nodes.

Proposed resolution

Add Group roles to the Webform's Access tab (/admin/structure/webform/manage/{webform}/access) and the Webform Element Access group (/admin/structure/webform/manage/{webform}/element/{element_key}/edit). When a group's webform node is loaded we will check the current user's group roles against the current webform's operation's assigned group roles.

Remaining tasks

• Create webform_demo_group.module to set up demo groups, roles, nodes, webforms, and submissions.
• Create dedicate webform_group.module
• Update webform.entity.webform.schema to support 'access.group_roles'. @see hook_config_schema_info_alter()
• Create webform_groups access control element
• Refactor and update Webform Access tab (/admin/structure/webform/manage/contact/access) @see \Drupal\webform\EntitySettings\WebformEntitySettingsAccessForm
• Refactor and update Element access checker to support group roles.
• Add hook support to webform_query_webform_submission_access_alter() via HOOK_webform_query_webform_submission_access_alter();

Notes

• https://api.drupal.org/api/drupal/core!core.api.php/function/hook_config...
• Issue #2856333: Webform as group content

Webform Group Role Permissions

• Create submissions
• View any submissions
• Update any submissions
• Delete any submissions
• Purge any submissions
• View own submissions
• Update own submissions
• Delete own submissions
• Administer submissions

Note: Access webform configuration permission is not applicable to group roles.

User interface changes

New group roles access element

API changes

New hooks.

Data model changes

N/A

Release notes snippet

TBD

User Acceptance Testing

Setup

• Enable the Webform Demo Group module -/admin/modules
• Confirm Webform Group module is marked as experimental /admin/reports/status

Form Builder

• Create webform -/admin/structure/webform/add
• Assign and remove Group Roles via the Access tab - /admin/structure/webform/manage/{webform}/access
• Confirm warning message below group roles is displayed when Anonymous or Authenticated user roles are checked -/admin/structure/webform/manage/{webform}/access
• Assign Group Roles via the Element edit tab. -/admin/structure/webform/manage/{webform}/element/{element_key}/edit

Email Handler and Token support

• Confirm the email handler include Group token options - /admin/structure/webform/manage/{webform}/handlers/add/email

Member

• Login as a A:1 member -/user/login (username: webform_group_a_1_member / password: webform_group_a_1_member)
• Confirm A:1 member can access A:1 contact form -/webform/group/a/1/contact
• Confirm A:1 member can NOT access A:2 contact form with an access denied message. - /webform/group/a/2/contact
• Confirm that no reviewer, manager, or administrator elements are accessible -/webform/group/a/2/contact

Reviewer

• Login as a A:1 reviewer -/user/login (username: webform_group_a_1_reviewer / password: webform_group_a_1_reviewer)
• Confirm A:1 manager can review (view) A:1 contact form submission - /webform/group/a/1/contact
• Confirm that reviewer element is accessible - /webform/group/a/2/contact

Manager

• Login as a A:1 manager -/user/login (username: webform_group_a_1_manager / password: webform_group_a_1_manager)
• Confirm A:1 manager can manage (view, update, and delete) A:1 contact form submission - /webform/group/a/1/contact
• Confirm that manager element is accessible - /webform/group/a/2/contact

Administrator

• Login as a A:1 administrator - /user/login (username: webform_group_a_1_administrator / password: webform_group_a_1_administrator)
• Confirm A:1 administrator can administer A:1 contact form -/webform/group/a/1/contact
• Confirm that administrator see all elements. -/webform/group/a/2/contact