2

I've built a site where all of the content is essentially private. All the relevant content types are Unpublished and my users (role=Owner) only have permissions to view/edit/delete their own Content. This is working just fine.

However, requirements have changed and I'm trying to figure out what to do. The new requirement is that an Owner can give permission to another user (role=OwnerAssistant) to view/edit/delete their data. I'll refer to the group of users that all administer the same dataset as an OwnerGroup.

It will not be feasible to create a Role for each of these groups because each new customer would need a separate role and we're hopefully going to have 50,000+ customers.

How can I control the permissions on a node so that a specific list of users can view/edit/delete that content? I'm ok with maintaining my own DB table that tracks the mapping of OwnerAssistants to Owners so that I have a way of determine if an OwnerAssistant is allowed to access content created by the Owner. However, I don't know how to let drupal know that uids 234, 894, and 1029 have x,y,z permissions to node 24590.

I will likely be integrating this with the Field Permissions module because I want to hide certain fields from OwnerAssistants.

Any help is appreciated!

Improve this question

2 Answers 2

Reset to default
1

How about using Entity Reference to designate non-owner users that may edit the node?

You could make your own module with a function to handle permission checks, i.e. "return TRUE if user is referenced on node".

Then use other hooks (hook_form_alter() for instance) to show/hide edit buttons and override edit privileges on nodes.

You can secure it by making the entity reference field only accessible by the content owner.

Improve this answer
4
  • I was under the impression that hook_permission() is only for permissions that my module defines. I'm not defining any custom permissions, I'm just using drupal's normal permissions per content type ("MyContentType: Edit own Content").
    – Kenny Wyland
    Feb 13, 2015 at 4:09
  • Ah yes, true, you needn't use hook_permission. Just create a handler instead. The rest should still work. Changed answer to reflect.
    – Darvanen
    Feb 13, 2015 at 4:13
  • I need to actually control permissions though, not just override forms, because I need want content listings to exclude things they don't have permissions to access.
    – Kenny Wyland
    Feb 13, 2015 at 4:38
  • Ah right, fun. Looks like Señor Reynolds has the right idea =)
    – Darvanen
    Feb 13, 2015 at 5:08
1

Try module Node access user reference

Gives content access permissions to users for content that references the users with User reference or Entity reference.

This is great if you want your content authors to be able to choose additional authors, or choose who can view their content, as well as being able to display the list of authors or viewers within your content, or in views displays.

Improve this answer
2
  • I'll read through the docs for that module tomorrow. Do you happen to know if those permissions need to be set on each node, or can they be set on the User entity? For example, could I add a User Reference on the Owner's user entity that lists the extra users (OwnerAssistants) and then that will be used for access permissions on all of the Owner's content?
    – Kenny Wyland
    Feb 13, 2015 at 4:42
  • I doubt that, but you could code around that or even use Rules to set/unset the user reference on a node automatically (when referencing user from a user, or creating new content). In code would probably be better.
    – J. Reynolds
    Feb 13, 2015 at 4:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.