Problem/Motivation

While it's becoming clearer with more research, I'm still not 100% certain what's required to harden custom content type entity access when it comes to entity query logic.

While explicit access checking on entity queries is required, see change record Access checking must be explicitly specified on content entity queries, I had the impression entity access checking was being performed on entity queries. I think it's not though. See #3367490: Node's "base_table" metatag is a nightmare for generic entity query access.

I think it would be helpful to clear the air and give developers a specific path forward until there is a robust core solution, e.g. #777578: Add an entity query access API and deprecate hook_query_ENTITY_TYPE_access_alter().

Related issues/links
* Entity query on custom entity is not checking access rights
* Need to implement hook_query_TAG_alter per parent entity type to work with views correctly?
* #777578: Add an entity query access API and deprecate hook_query_ENTITY_TYPE_access_alter()
* Entity API module change record: Added an entity query access API
* #3367490: Node's "base_table" metatag is a nightmare for generic entity query access
* #2997705: Listing custom entities with proper view access

Steps to reproduce

N/A - it's a support request

Proposed resolution

Update the following documentation
* Update entity.api.php "Access checking on entities" section to include information for entity query access checking
* Update change record: Access checking must be explicitly specified on content entity queries
* Update "Creating a custom content entity" docs page as necessary or conslidate with the next docs page
* Update "Creating a content entity type in Drupal 8" docs page with information about entity query access check or update access control handler section
* Update "Converting a content entity type to be revisionable and publishable" docs page as necessary for access checking considerations when converting

N/A

Remaining tasks

* Discuss options
* Choose an option to communicate to developers
* Discuss how to communicate, e.g. entity.api.php, doc pages, change records
* Update any related issues to help socialize

User interface changes

N/A

API changes

Too be determined

Data model changes

N/A

Release notes snippet

Too be determined

Comments

jasonawant created an issue. See original summary.

jasonawant’s picture

jasonawant
he/him
Primary language English
Location New Orleans, USA
commented
Issue summary: View changes

Version: 10.2.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

jasonawant’s picture

jasonawant
he/him
Primary language English
Location New Orleans, USA
commented
Title: Does entity query access checking perform any access checking for custom content type entity » Does entity query access checking perform any access checking for custom content type entity?

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.

quietone’s picture

quietone commented
Status: Active » Postponed (maintainer needs more info)

This support request has not had any discussion in two years. The issue summary mentions updating community docs. I checked those and several have been updated since this issue was created. However, I don't know if those changes addressed the issue here. In each case, those are community docs which anyone can improve.

Improvements for entity.api.php has been recommended but there is no suggested text or an MR. But that file has also changed in the last 2 years. If there are improvement to be made it would help to change this issue from a Support Request to either a Task of a Bug Report and create an MR.

The Drupal Core issue queue is not the ideal place for support requests. The 'support request' option is there for filing support issues for contributed modules and themes. There are several support options listed on our Support page, including the Drupal Forums and Drupal Answers. There is also Drupal Slack. You may get better replies in one of those places.