Problem/Motivation

It has been identified that in contexts involving custom entities with restricted access permissions, the Entity Mesh system is processing these entities under two specific scenarios:

  • When a batch process is executed from the Drupal administration UI (not via Drush).
  • When the entity is created or updated by a user who has permissions to access the entity.

In both cases, Entity Mesh processes the entity without evaluating whether it should be visible to anonymous users or other specific roles. This can lead to incorrect results.

Thus, it is not sufficient to check access based only on the current user; role-based access validation is required, especially for anonymous users.

A dedicated access-checking service will be implemented to support this requirement and allow future extension to other roles or user profiles.

Steps to reproduce

  • Define a entity type with restricted view permissions (e.g., only accessible to authenticated users).
  • As an authenticated user with create/update permissions: Create or update an instance of the custom entity or
  • Trigger a batch process via the Drupal admin UI that integrates with Entity Mesh.
  • Observe that the entity is processed by the Entity Mesh system.
  • Access to the Entity Mesh report and confirm that the entity is included in it.

Proposed resolution

Develop a service that performs entity access checks for a specific role, starting with anonymous users.

Integrate this service into the Entity Mesh processing flow to ensure that:

  • Entities are not processed unless they are accessible to the designated role(s).
  • Design the service to be extensible, allowing the system to support access checks for other roles or user personas in the future.
  • Ensure batch processes initiated from the UI follow the same access logic as Drush commands.

Remaining tasks

  • Implement the role-based entity access validation service.
  • Update Entity Mesh logic to incorporate the role-based check before processing entities.
  • Apply consistent behavior across different batch triggers (UI and Drush).
  • Write test coverage

User interface changes

None expected immediately. Future improvements may introduce administrative configuration for selecting roles to check access against.

API changes

Introduction of a new service for role-based entity access validation.
No breaking changes to existing APIs.

Data model changes

None.

Issue fork entity_mesh-3535302

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

lpeidro created an issue. See original summary.

lpeidro’s picture

lpeidro commented
Title: Entity Mesh processes restricted custom entities via batch UI without validating anonymous user access » Entity Mesh processes entities via batch UI without validating anonymous user access

lpeidro opened merge request !39

lpeidro’s picture

lpeidro commented

I have implemented the AccountInterface in a class named DummyAccount. This class allows us to instantiate account objects with a specific role, which we can use to test role-based access to entities. Currently, it only tests access for anonymous users, but in the future, we plan to expand its functionality to support different roles.

The access check to the entity is performed just before creating the source object for a given entity. Doing it at this point ensures that, in all contexts, only the entities accessible to the anonymous user will be processed.

I have implemented a unit test for this scenario.

It is ready to be checked by the comunnity.

lpeidro’s picture

lpeidro commented
Status: Active » Needs review
eduardo morales alberti’s picture

eduardo morales alberti
Primary language Spanish
Location Spain, 🇪🇺
commented

Could you review the coding standard errors?

PHP CODE SNIFFER REPORT SUMMARY
----------------------------------------------------------------------
FILE                                                  ERRORS  WARNINGS
----------------------------------------------------------------------
entity_mesh.libraries.yml                             1       0
entity_mesh.permissions.yml                           1       0
entity_mesh.routing.yml                               1       0
src/DummyAccount.php                                  22      0
src/Repository.php                                    1       0
tests/src/Kernel/EntityMeshPermissionsTest.php        12      7
----------------------------------------------------------------------
A TOTAL OF 38 ERRORS AND 7 WARNINGS WERE FOUND IN 60 FILES
----------------------------------------------------------------------
PHPCBF CAN FIX 43 OF THESE SNIFF VIOLATIONS AUTOMATICALLY
----------------------------------------------------------------------
PHP CODE SNIFFER VIOLATION SOURCE SUMMARY
----------------------------------------------------------------------
    SOURCE                                                       COUNT
----------------------------------------------------------------------
[x] Drupal.Commenting.PostStatementComment.Found                 15
[x] Drupal.Commenting.InlineComment.InvalidEndChar               14
[x] Drupal.Classes.UnusedUseStatement.UnusedUse                  4
[x] Drupal.WhiteSpace.Comma.TooManySpaces                        4
[x] Drupal.Arrays.Array.CommaLastItem                            2
[x] Drupal.Files.EndFileNewline.TooMany                          2
[x] Drupal.Commenting.DocComment.TagGroupSpacing                 1
[ ] Drupal.Commenting.FunctionComment.MissingReturnComment       1
[x] Drupal.Files.EndFileNewline.NoneFound                        1
[ ] Drupal.Files.LineLength.TooLong                              1
----------------------------------------------------------------------
A TOTAL OF 45 SNIFF VIOLATIONS WERE FOUND IN 10 SOURCES
----------------------------------------------------------------------
PHPCBF CAN FIX THE 8 MARKED SOURCES AUTOMATICALLY (43 VIOLATIONS IN TOTAL)
----------------------------------------------------------------------
juanjol’s picture

juanjol
Primary language Spanish
commented
Status: Needs review » Needs work

Thanks for the MR! The implementation looks good.

Two minor suggestions :

  1. Consider renaming DummyAccount to AnonymousDummyAccount for clarity
  2. Maybe use dependency injection instead of the static variable in Repository::checkAccessEntity() to follow Drupal best practices
juanjol’s picture

juanjol
Primary language Spanish
commented

Please take a look too to the phpcs in the pipeline https://git.drupalcode.org/project/entity_mesh/-/jobs/5876370

Didn't see comment #6

lpeidro’s picture

lpeidro commented

Hello Juanjol:

I would to keep the name DummyAccount. We need a generic term that we can reuse to check access for anonymous users and for users with other roles in the future. Renaming it to AnonymousDummyAccount would be too specific. For clarity, I will rename the variable $account (the instantiated object) to $anonymous_account.

  public function checkAccessEntity(EntityInterface $entity): bool {
    static $anonymous_account;

    if (!$anonymous_account) {
      $anonymous_account = DummyAccount::create();
      $anonymous_account->setAsAnonymous(); // Set the dummy account as anonymous.
    }

    return $entity->access('view', $anonymous_account);
  }

Regarding the second point, I prefer to keep the static variable rather than use dependency injection. This is not a service; it is a dummy object.

lpeidro’s picture

lpeidro commented
Status: Needs work » Fixed

I merge the issue.

  • lpeidro committed ba374c94 on 1.x 
    Issue #3535302: Rename variable for clarity

  • lpeidro committed 2ff7d5b8 on 1.x 
    Issue #3535302: Call to the new repository method to check access

  • lpeidro committed 8a0612a3 on 1.x 
    Issue #3535302: Create a new method in entity mesh repository check...

  • lpeidro committed aa576fe7 on 1.x 
    Issue #3535302: Create a custom class to create dummy accounts to check...

  • lpeidro committed 5b411ec9 on 1.x 
    Issue #3535302: Fix phpunit, reducing configuraion and fix html filter

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.