Nodegrants

Nodegrants lets you decide who can view, edit or delete a single piece of content. Instead of relying on role-wide content permissions or taxonomy workarounds, you grant view, edit and delete access on each node to specific roles and individual users, right on the node's add and edit form. Every content type carries its own default grants, so new content starts out protected the way you want.

Nodegrants is based on the functionality of the long-standing Nodeaccess module, but it is a complete rewrite from the ground up for Drupal 11.4 and 12. It keeps the ideas that made Nodeaccess useful, namely per-node grants for roles and users and per-type defaults, while leaving behind the legacy code and the separate grants tab. The result is a module built on current core APIs, written in modern PHP, and designed to stay compatible with the Drupal 12 release series.

Features

• Per-node grants for roles and users. View, edit and delete can each be granted separately to any role or to a named user account.
• Grants live on the node form. A Nodegrants pane appears on the add and edit form of every enabled content type. On Drupal 12's Default Admin theme (or Claro) it sits in the sidebar, so there is no separate tab to visit.
• Content type defaults. Set default view, edit and delete grants per role, plus a dedicated row for the node author, on each content type's edit page. New nodes start from those defaults.
• Author grants follow ownership. Author access is based on the node's current owner, so reassigning a node moves the author's rights with it.
• You choose which roles appear. Only roles with the "Include in Nodegrants grants" permission show up in grant forms. Give it to the Authenticated user role and every logged-in role is included.
• User autocomplete. Add a user by typing their name. Users already granted on the node are listed with their current rights and a remove link.
• A master switch per content type. Turn Nodegrants off for a type and its stored grants are kept but ignored. Turn it back on and they return.
• Built on core's node access API. Grants are stored in Drupal's node access table, so Views listings and search results honour them just like the node pages themselves.
• Drush command. drush ng:rebuild (full name nodegrants:rebuild) rebuilds the content access permissions from the command line, the same as the "Rebuild permissions" button. Requires Drush 13.7 or later.
• Modern requirements. Drupal 11.4 or 12 and PHP 8.4 or later. Installed with Composer as drupal/nodegrants. It replaces, and conflicts with, the legacy drupal/nodeaccess package.

After installation: enabling Nodegrants on a content type

1. Install and enable the module.

   composer require drupal/nodegrants
   drush en nodegrants

   You can also enable it from Extend (/admin/modules). If drupal/nodeaccess is installed, remove it first; the two packages cannot coexist.

2. Assign permissions. Go to People › Permissions (/admin/people/permissions) and set:
   • Include in Nodegrants grants for every role that should be selectable in grant forms. Giving it to Authenticated user includes all logged-in roles at once.
   • Grant Node Permissions for the roles that will manage grants on individual nodes. Without it the Nodegrants pane does not appear on the node form.
   • Administer Nodegrants for site administrators. It unlocks the admin page and the per-user remove links.
3. Turn it on for the content type. Go to Structure › Content types, choose Edit on the type (for example /admin/structure/types/manage/article), and open the Nodegrants tab among the vertical tabs at the bottom of the form. Check Show grant tab for this node type, then tick the default View, Edit and Delete boxes for each role and for the Node Author row. Save the content type.
4. Rebuild content access permissions. The change affects every existing node of that type, so Drupal shows a notice that the content access permissions need to be rebuilt. Follow its link, or go to Reports › Status report › Rebuild permissions (/admin/reports/status/rebuild). Or from the command line:

   drush ng:rebuild

5. Set grants on a node. Create or edit a node of that type. On the Default Admin theme the Nodegrants pane sits in the right-hand sidebar; expand it to see the role table pre-filled with the content type defaults. Adjust the boxes, add a user with the autocomplete field and tick their rights, then save. From that save on, the node uses its own grants rather than the type defaults.
6. Optional: check the role map. Structure › Nodegrants (/admin/structure/nodegrants) shows the mapping between roles and grant IDs and lets you rebuild it if roles have been added or removed.