Problem/Motivation

I'm working to extend access handling on a site and need to reproduce much of the group content access checking from GroupContentAccessControlHandler::entityAccess and GroupContentAccessControlHandler::relationAccess. Both of these methods call GroupAccessResult::allowedIfHasGroupPermissions(). Simply refactor this into a small helper method that can be overridden without needing to duplicate large swaths of logic. I don't want to duplicate that logic, because then upstream bug fixes for permissions there won't be available to my overridden code.

Steps to reproduce

Proposed resolution

Extract the method call into a new method, getGroupContentAccessResult

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork group-3202249

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

heddn created an issue. See original summary.

heddn’s picture

Status: Active » Needs review
StatusFileSize
new1.99 KB
heddn’s picture

StatusFileSize
new1.9 KB
new2.09 KB

Add some context to the access checking.

kristiaanvandeneynde’s picture

Status: Needs review » Needs work

I'd go about this differently:

  • Create a new method like combinedPermissionsCheck() that expects an array of permissions.
  • In combinedPermissionCheck(), wrap the single permission in an array and hand it off to combinedPermissionsCheck()
  • Deprecate combinedPermissionCheck()
  • Now remove the explicit addition of the admin permission in relationAccess() and entityAccess() and have them call combinedPermissionsCheck() also

This means we only have one protected "permission check method" and it's called consistently from all 4 public methods.

heddn’s picture

Status: Needs work » Needs review
StatusFileSize
new6.31 KB
new8.09 KB

I tried doing exactly what you mentioned. Which made a lot of sense. But as typical when implementing lofty goals, I ran into issues. I need the group content and the operation as context to do what I need to do. So I did the next best thing, implemented the suggestion in spirit.

kristiaanvandeneynde’s picture

Status: Needs review » Needs work
+++ b/src/Plugin/GroupContentAccessControlHandler.php
@@ -183,8 +175,68 @@ class GroupContentAccessControlHandler extends GroupContentHandlerBase implement
-    return $this->combinedPermissionCheck($group, $account, $permission, $return_as_object);

We can't stop calling the original one. That would be a BC break. We need to mark the original as deprecated, but keep calling it (as a wrapper ar0und the new one) until 2.0

heddn’s picture

StatusFileSize
new1.17 KB
new7.38 KB

I'm not sure I follow why not calling the original method would be a BC break. We leave it there for "others" to call, but why do we need to call it?

Did make changes so original calls the new method. Which are now attached.

kristiaanvandeneynde’s picture

Suppose I read the code and instead of overwriting relationCreateAccess and entityCreateAccess, I chose to overwrite combinedPermissionCheck(). Now that method is not being called at all any more, so my overrides all of a sudden get ignored.

That's a BC break.

kristiaanvandeneynde’s picture

Status: Needs work » Needs review

This is what I had in mind. (Note I did not pass along the operation like you did, feel free to add that in)

heddn’s picture

The operation and splitting out group from group content is important (for my use case). I'll add that to the MR.

heddn’s picture

Fixed phpcs. Looks like the prophecies need some adjustments on tests still.