Access webform by checking predefined codes

Question

If I set up a webform with one component "authrization code", which is predefined by my side. People can access the form only when they get the authorized unique code from me. Is there any way to realize this? I tried a module "webform invitation", but have the same problem as described "any code is accepted"(my system is D8.64,php7.0). If I add a text field for code validation, I don't know where to predefine those codes and how to check. Another question is how can I produce those unique codes and transfer them to QR codes so that people can scan them to automatically fill in the form? Appreciate for any help in advance!

Answer 1

You can create a custom module with a hook_webform_access() callback that looks for authorizations codes.

The below hook grants access to the default Contact form via /form/contact?code=secretcode. Make sure to go to /admin/structure/webform/manage/contact/access and remove 'Create submissions' access to the Contact form.

/**
 * Implements hook_webform_access().
 */
function CUSTOM_MODULE_webform_access(\Drupal\Core\Entity\EntityInterface $entity, $operation, \Drupal\Core\Session\AccountInterface $account) {
  // List of webform ids and authorization codes.
  $webform_authorization_codes = [
    'contact' => 'secretcode',
  ];

  // Get the current webform.
  /** @var \Drupal\webform\WebformRequestInterface $request_handler */
  $request_handler = \Drupal::service('webform.request');
  $webform = $request_handler->getCurrentWebform();
  if (!$webform) {
    return \Drupal\Core\Access\AccessResult::neutral();
  }

  // Get the webform id.
  $webform_id = $webform->id();
  if (!isset($webform_authorization_codes[$webform_id])) {
    return \Drupal\Core\Access\AccessResult::neutral();
  }

  // Get get the code.
  $code = \Drupal::request()->get('code');
  if (empty($code)) {
    return \Drupal\Core\Access\AccessResult::neutral();
  }

  // If 'submission_page' (aka create) and authorization code is correct,
  // then grant access.
  if ($operation === 'submission_page' && $code === $webform_authorization_codes[$webform_id]) {
    return \Drupal\Core\Access\AccessResult::allowed();
  }
  else {
    return \Drupal\Core\Access\AccessResult::neutral();
  }
}