I have been using Drupal for many years now (starting with Drupal 6) and only recently - in the context of a big project - made the switch to D8. So far, working with D8 has been a very pleasant experience, to say the least. I was prepared, however, that there would be a few rocks on the road. And I would like to ask for help removing a big one (for me)...
In a nutshell, the situation is this: I am creating a kind of learning management system (LMS), with
classes. Each lesson belongs to exactly one course, but each courses may or may not belong to zero, one or more classes. I was thinking of using simple node references to structure this:
- a field in the content type lesson that references the course that this lesson belongs to
- and an entity reference field in the content type class that references all courses in this class (so, this is referenced the other way round)
Now, I'd like to sell access to each of these content types and my problem is this: If a user buys access to one of the classes, she should also be able to access all of the courses (and lessons) that are referenced by this class. So, when checking the access permissions for a single course, the system will not only have to check, if the user has bought this course, but also, if the user has access to a class that contains this course.
I was first thinking of solving this with the module Node access node reference, but this seems to work the other way round (and doesn't have a D8 version). Same for Access by Reference. (In general, most of the access control modules I looked at, don't seem to be ready for D8 yet.) But what about rule-based access control? Or groups?
Can anybody suggest a way forword?
Any help would be much appreciated. Thanks in advance.