User may edit their webform submissions, but only while in draft

Question

I don't want users to be able to edit their webform submissions after they have been submitted (in this case it's an application form that needs to be reviewed).

The trouble is, they also need to be able to partially complete and return to it. If they've saved a draft, to continue, they have to access:

/webform/{webform}/submissions/{webform_submission}/edit

and with 'Update own webform submissions' disallowed (which you can do per webform, remember) that route is blocked.

I can't see anything obvious in the options for drafts (Settings > Submissions) yet I can't be the first person to have needed this…

Solution I've come up with so far:

• enabling edit/update access for all users
• adding a RouteSubscriber for entity.webform.user.submission.edit
• loading the submission there, using ->isDraft() to check its status
• denying access for false, depending on role/ownership

Any better ideas?

(NB: this doesn't involve anonymous users - they have to be registered and logged in.)

Answer 1

You don't need a custom route, you can hook into the entity access check for the existing entity routes:

mymodule.module:

use Drupal\Core\Session\AccountInterface;
use Drupal\Core\Access\AccessResult;
use Drupal\webform\WebformSubmissionInterface;

/**
 * Implements hook_ENTITY_TYPE_access().
 */
function mymodule_webform_submission_access(WebformSubmissionInterface $webform_submission, $op, AccountInterface $account) {
  if ($op == 'edit' && !$webform_submission->isDraft() && in_array('role', $account->getRoles())) {
    return AccessResult::forbidden()->cachePerPermissions();
  }
  return AccessResult::neutral()->cachePerPermissions();
}