How to skip the ReferenceAccess constraint on a file upload by an anonymous user?

Question

I have a contact form for job applications with a file field on it so users can upload their CV. Because of privacy / security, the uploaded CV's must be stored in the private filesystem.

Unfortunately, a problem occurs when an anonymous user tries to add a CV and submit the form. Since the anonymous user does not have access to the uploaded file, the file field's ReferenceAccess constraint (\Drupal\Core\Entity\Plugin\Validation\Constraint\ReferenceAccessConstraint) kicks in and throws a validation error: You do not have access to the referenced entity (file: 1). As a consequence, the user is not allowed to submit the form.

Is there a way to tell Drupal to skip the ReferenceAccess constraint when anonymous users reference a file that they just uploaded themselves?

Update: I came to realize that this does not happen when using the core file field, only with the File Entity module.

Answer 1

That constraint is validated by \Drupal\Core\Entity\Plugin\Validation\Constraint\ReferenceAccessConstraintValidator. ReferenceAccessConstraintValidator::validate uses the following code.

  /* @var \Drupal\Core\Entity\FieldableEntityInterface $referenced_entity */
  $referenced_entity = $value->entity;
  if ($referenced_entity) {
    $entity = $value->getEntity();
    $check_permission = TRUE;
    if (!$entity->isNew()) {
      $existing_entity = \Drupal::entityManager()->getStorage($entity->getEntityTypeId())->loadUnchanged($entity->id());
      $referenced_entities = $existing_entity->{$value->getFieldDefinition()->getName()}->referencedEntities();

      // Check permission if we are not already referencing the entity.
      foreach ($referenced_entities as $ref) {
        if (isset($referenced_entities[$ref->id()])) {
          $check_permission = FALSE;
          break;
        }
      }
    }

    // We check that the current user had access to view any newly added
    // referenced entity.
    if ($check_permission && !$referenced_entity->access('view')) {
      $type = $value->getFieldDefinition()->getSetting('target_type');
      $this->context->addViolation($constraint->message, [
        '%type' => $type,
        '%id' => $id,
      ]);
    }
  }

(In particular, see the line containing $referenced_entity->access('view').)

We can hook into the file's access control to alter the outcome, with hook_entity_access() or hook_ENTITY_TYPE_access().

Another solution could be to create a new field type which inherits everything from Drupal\file\Plugin\Field\FieldType\FileItem, except for the ReferenceAccess constraint in its plugin definition. You can do this in two ways:

1. Create a new plugin class that extends the original class, and copy and modify its docblock, including the @FieldType annotation.

2. Implement hook_field_info_alter(), copy the file plugin definition to your own, and make the necessary adjustments there.