Problem/Motivation
The mapped roles are stored in a field on the user. Only one profile can revoke roles correctly.
Steps to reproduce
Proposed resolution
Use the user.data service to store the mappings. This will allow every profile to revoke roles previously granted correctly.
$user = \Drupal::currentUser();
// Define an array of role => profile.
$roles= [
'administrator' => 'profile_a',
'teacher' => 'profile_b',
'staff' => 'profile_b',
];
// Store the array as user data.
\Drupal::service('user.data')->set('authorization_drupal_roles', $user->id(), 'roles', $roles);
Remaining tasks
Update existing code to use user.data.
Write hook_update_N function to store the users existing roles.
Remove 'authorization_drupal_roles_roles' field.
User interface changes
API changes
Data model changes
The 'authorization_drupal_roles_roles' field will be removed from the user.
Comments
Comment #3
bluegeek9 commentedComment #5
bluegeek9 commentedComment #6
bluegeek9 commentedI want integration tests for the update function. This is the largest change to authorization since the 'authorization_drupal_roles_roles' field was introduced.
Comment #7
bluegeek9 commentedDrupal 11 is here.