I have created an entity reference field on a node type and it references entities of the Profile type, my Profile bundle is called 'Staff profile'.

I want to allow certain users to see staff profiles of other users in this entity reference field, but I don't want them to see ALL users staff profiles.

If a user has the permission "Staff: View any profiles" then they can see EVERY profile in this entity reference field, once I remove this they can only see their own - this is as expected and does seem to indicate my issue is with permissions.

So I am trying to allow this access to certain profiles for certain users in a 'my_module_profile_access' function. And this is working in that if I try to view a profile directly i.e. I go to /profile/123 (with a user whom I have allowed access to view the profile) it works fine, it works as expected.

However this behaviour does not repeat itself when I try to use the entity reference field, which makes me suspect there is some other permissions interfering here?

For what it is worth my hook_entity_access function looks something like this -

function my_module_profile_access(Profile $profile, $op, $account) {
  $profileOwner = $profile->getOwner();
  if ($account->id() == '2' && $profileOwner->id() == '123') {
      return AccessResult::allowed()->cachePerUser()->addCacheableDependency($profile);
  // No opinion.
  return AccessResult::neutral();


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.