How to restrict access to specific content types by role? [duplicate]

Question

In D8 core you can either set permission for anonymous users to view all or non publish content, but not set permission different by content type.

I've found this that looked promising, but the functionalities doesn't work for this:

http://drupal.org/project/content_access

Any others suggestions for how to solve this?

Answer 1

You could use the Group module for this. Group allows for creating arbitrary collections of your content and users on your site, and grant access control permissions on those collections. The Group module creates groups as entities, making them fully fieldable, extensible and exportable.

Some basics about he Group module to be aware of:

• Make sure you enable gnode, a submodule of the Group module.
• For each group type you need to define the appropriate permissions (view, edit, delete, etc) for the various Content Types.
• Every group can have users, roles and permissions attached to it (refer to "What are the various roles supported by the Group module?" for more details about that).

With the appropriate permissions configured, it's just a matter of assigning a node to a Group: based on how you configured the roles and permissions, the Group module will allowed/deny access for any user. Refer to "How to create collections of content that can be accessed by users with various access levels?" for more info about all this.

Resources

• Community documentation for the Group module.
• Video tutorial "How to use the Group module in Drupal 8 to manage editorial access control to different areas of a web site".

Notes (to further address your comment below this answer):

• ... I want to give access to anonymous users, I guess they can't be part of a group?

  True, an anonymous user, by design, cannot be part of a group. But as mentioned in my answer to "What are the various roles supported by the Group module?": the role "Anonymous" (related to a user that is not signed) is one of the Special Global Roles (apart from Outsider and Member). And it is via that Special Global Role "Anonymous" that you can make the magic happen for any anonymous user. Have a look at the video tutorial, around 10:53, where you can see that it is possible to grant access to anonymous users* to (eg) "View content" to a Group node (of content type "Article").

• ... I would then need to add every person to those groups instead of just assigning permissions to their roles?

  If you'd grant appropriate permissions for Outsider (combined with the access you want for Anonymous), they do not have to be part of those groups.

• ... It seem like a little bit bad work-around for my need.

  With the above details included in this note, I presume you agree that this part of your comment no longer applies.

Bonus tip:

A possible solution to "... make all 'article' nodes be content of an 'articles' group." (as in another comment added to this answer) is explained in comment nr 3 of the issue titled Bulk assign of content to groups. This is part of what it says:

The steps to take are roughly:

1. Make sure you have a GroupType
2. Make sure the GroupType has the right plugins enabled (GroupType::installContentPlugin(); read deprecation notice)
3. Create a Group of said GroupType
4. Start adding the nodes using $group->addContent($node, 'group_node:NODE_TYPE_HERE');

For D7 one can use Views Bulk Operations (VBO) and Rules as detailed in my answer to "How to bulk assign existing content to a group created with the Group module?").