0

I need to create a permission system using a node reference field. In this scenario nodes are products and users are printers. Site administrators can assign printers to each product and printers can only see the products containing a reference to them.

Using hook_node_access(), I can control the access, but a view doesn't seem to invoke it.

That is why started with hook_node_access_records() and hook_node_grants(), but I don't see how I can send the user ID from hook_node_grants() to hook_node_access_records() and how to use the node ID with hook_node_access_records().

The main problem is that views are ignoring hook_node_access(). Since I have many views, I would like to limit the results globally for all views.

function hook_node_access(NodeInterface $node, $op, AccountInterface $account) {
  $type = $node->getType();

  if (in_array($type, array('product')) && $op == 'view' && !in_array('employee', $account->getRoles())) {
    if($account->id() == $node->field_printer_ref->entity) {
        return AccessResult::allowed();
    }
    else {
      return  AccessResult::forbidden();
    }
  }
  return AccessResult::neutral();
}
function hook_node_access_records(NodeInterface $node) {
  if ($node->field_printer_ref->entity) {
      $grants[] = array(
        'realm' => 'custom_access',
        'gid' =>  // can I use account id here?
        'grant_view' => 1,
        'grant_update' => 0,
        'grant_delete' => 0,
        // where is node id? can I setup individueal ? 
      );
    } 

    $grants[] = array(
    'realm' => 'custom_access',
    'gid' => 0, // This is the admin GID, not the $account->uid associated with anonymous
    'grant_view' => 1,
    'grant_update' => 1,
    'grant_delete' => 1,
    );
  }
  return $grants;
}

function adpomail_node_grants(AccountInterface $account, $op) {
  $accountId = $account->id();
  if (in_array('printer', $account->getRoles())) {
    $grants['custom_access'] = array($accountId);
  }
  if (in_array('administrator', $account->getRoles())) {
    // gid to view, update, delete
    $grants['custom_access'][] = 0;

  }
  return $grants;
}

How do I limit the nodes show from the view?

  • What do you mean by improve the hook_node_access OR hook_node_access_records? The first hook is not used in a view, or in a page showing a list of entities. – kiamlaluno May 11 at 10:45
  • @kiamlaluno valid point. if hook_node_access is not used in a view, can I use something equivalent for views data result access - I don;t want use filters, but control real access. – adpo May 11 at 11:16
  • hook_node_access() is a general hook for accessing nodes. However, when doing DB queries, such as with views, hook_node_access() cannot be used, as it is a PHP process, not a DB query process. hook_node_access_records() and hook_node_grants() work together to create a table in the database that can be queried in DB queries, and is what you want to restrict access to nodes retrieved by views. – Jaypan May 11 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.