View only your own comments, no one else's?

Question

I have a client who would like users to be able to comment on content without being able to see any other users' comments. This is for a review system where users shouldn't feel influenced by the views of other users. I'm using Drupal 9.3.14 and a subtheme of Radix.

I have tried adding this to my theme's comment.html.twig:

{% if author_id == user.id %}
    {{ content }}
{% endif %}

That works for a while, but after a while, users report that they can see some other users' comments, but not all of them.

How can I make sure that users can always see only their own comments and no one else's?

Answer 1

Finding hook_ENTITY_TYPE_access/hook_comment_access not working when trying to return AccessResult::forbidden()->cachePerUser() after comparing the comment owner ID and current user ID (probably related: #2879087), can you please try the following preprocess logic? As I currently have no project to properly check this out myself I'm not sure if it works that way and if #plain_text can simply be (mis-)used as a cache busting switch in a template at all.

/**
 * Implements hook_preprocess_HOOK().
 */
function MYMODULE_preprocess_comment(&$variables) {
  $variables['own_comment'] = [
    '#plain_text' => 'no',
    '#cache' => [
      'contexts' => ['user'],
    ],
  ];
  /** @var \Drupal\comment\Entity\Comment $comment */
  $comment = $variables['elements']['#comment'];
  if ($comment->getOwner()->id() === \Drupal::currentUser()->id()) {
    $variables['own_comment']['#plain_text'] = 'yes';
  }
}

{% if own_comment['#plain_text'] == 'yes' %}
  {{ content }}
{% else %}
  {{ 'Not your comment'|t }}
{% endif %}

Maybe I'm actually doing the same you did and in the end the only way is to implement your own comments field formatter, similar to the one in the Manage comments on own content module.

Answer 2

Sorry, no code with this, just an idea to try. Focus on writing a new permission with a custom module, not modifying the html that is cached. If you hook into Drupal's permissions, then the cache may not be an issue anymore. Plus, this feels more like a permission issue than html issue.

If you install drupal/console, you can run a command lines like drupal generate:module to stub out the initial module then drupal generate:permissions to addon to that module a permission. Quick way to stub out a custom module and then put similar php logic you already have in your head, but just add it to drupal a different way.