Problem/Motivation

Note: This is obsolete once #777578: Add an entity query access API and deprecate hook_query_ENTITY_TYPE_access_alter() is generally used.

Use case

Combining domain and group access, and want that node acces is only allowed if domain AND group fit.

Background

The current access system ORs the Allow results. This use case wants them ANDed.

Proposed resolution

Add the option to combine entity access with AND instead of OR

Remaining tasks

* Investigate and create a POC that replaces OR with AND condition.
* Make that condition configurable
* Add tests
* Commit

User interface changes

New setting.

API changes

None.

Data model changes

None.

Release notes snippet

TBD

Comments

axel.rutz created an issue. See original summary.

geek-merlin’s picture

Patch flying in that might implement the POC.

anruether’s picture

comment posted in wrong issue and deleted.

Status: Needs review » Needs work

The last submitted patch, 2: drupal-3031981-2-entity-access-and.patch, failed testing. View results

geek-merlin’s picture

StatusFileSize
new3.14 KB

Fixed an issue with field access.

geek-merlin’s picture

Nope, the approach in the patches is too naive. Thinking...

hchonov’s picture

Use case
Combining domain and group access, and want that node acces is only allowed if domain AND group fit.

I think that you can implement a hook entity access and solve your problem. Or is there any other reason why you want to have it the other way around in core - which actually is won't fix, as we cannot change how the access results are being processed in the EntityAccessControlHandler .

geek-merlin’s picture

Status: Needs work » Closed (works as designed)

If we make this an option there is no BC issue.

Fortunately i found a contrib solution living in https://www.drupal.org/project/acb.