Is there a way to add node grants to anonymous users?

Question

I want anonymous users to be able to access nodes that are promoted to the front page. (They can't access to nodes that are not promoted.) It seems hook_node_access() isn't seem called for anonymous users. I tried using hook_node_grants() and hook_node_access_records(), but the code I am using doesn't seem to give anonymous users access to nodes promoted to front page.

function myModule_node_grants(\Drupal\Core\Session\AccountInterface $account, $op) {
   return ['show_promoted_news' => [9999]];
}

function myModule_node_access_records(\Drupal\node\NodeInterface $node) {

  $grants = [];

  if ($node->isPublished() and $node->isPromoted() and $node->getType() == 'article') {
    $grants[] = [
      'realm'        => 'show_promoted_news',
      'gid'          => 9999,
      'grant_view'   => 1,
      'grant_update' => 0,
      'grant_delete' => 0,
      'langcode'     => 'en'
    ];
  }

  return $grants;
} 

The access content permission is overriding the grants I give to the anonymous users, who can't access published content. Adding a greater priority does nothing.

I'm being forced to allow anonymous users to access content and override that when I don't want them to have access with hook_node_access().

Answer 1

You might get this to work by using the Group module. Below are some details about how to do so.

1. Configuration

• Create a Group Type (pick whatever name you want).

• For this case, there is no need for special (custom) Group Roles for the Group Type you created. Since you'll be able to configure what you want by using these Special Global Roles (hardcoded) that come with the Group module (they cannot be defined by the Drupal administrator, and they are always available for any Group Type):

  • "Outsider": a signed in user that did not join a group.
  • "Member": a signed in user that did join a group.
  • "Anonymous": a user that is not signed in.

• Create a Group (pick whatever name you want) for the Group Type you created, and let's say you name it "Promoted nodes" (feel free to use another name if you prefer).

• Grant the appropriate Group Permissions for the configured Group Type. To do so, you can also configure for each Content Type which Group Role has what kind of access (= none, view, create, edit, delete). Be aware: even though this looks similar to Drupal's permission configuration, these Group Permissions are not the same permissions (they are specific to the Group module). With the above setup in place, just grant "view" access to the Special Global Role named Anonymous (and pick whatever rights you want for the other roles).

2. Granting access

With the above Group module configuration in place, all you need to do is:

• assign each promoted node to the Group "Promoted nodes".
• remove the node from the group again if it is no longer promoted.

For sure this assign/remove can be done manually (whenever a node is edited), but it should be straight forward to somehow automate it using "promoted or not" as the trigger to do so (using the API that comes with the Group module).

More info

Refer to "How to create collections of content that can be accessed by users with various access levels?" for more info about all this.