Code that is put in either hook_entity_access or an access handler has no effect on listings such as views field displays and search. I am not sure if this is by design or due to an error from my side, but my guess is that the db queries don't have a way to factor in the generated then cached access results.

This bit I mean:

return AccessResult::forbidden()->cachePerPermissions()->cachePerUser()->addCacheableDependency($stuff);

Is there a way to factor it in listings? If not how should I go about applying the same logic in hook_entity_access or access handlers to listings?

  • Can you see a relevant cache context in the X-Drupal-Cache-Contexts response header for the listing? You may also be able to alter the views query to apply access control.( api.drupal.org/api/drupal/… ) That way you could vary the result and cache context for the user. – David Thomas Jan 7 at 9:53
  • I haven't had e a use for this before. Are these the ones listed under the main document/page? Query can do it, yes. Is that different from using entity queryAccess handler? – Jed_BH Jan 8 at 22:10
  • Entity queries don't have a way to pass cache metadata. They just bubble it up, which is OK when used in a render context but can cause problems when not. See drupal.stackexchange.com/questions/251864/… – 4k4 Jan 24 at 10:53
  • Is the better solution then to save the calculated access results to DB and alter queries to reflect the correct outcome? 4k4 is this more related to this drupal.org/project/drupal/issues/2876258 – Jed_BH Jan 27 at 6:57
  • The solution you describe is basically how Drupal implements node grants saving the access results in the table node_access and altering the node query in node_query_node_access_alter. – 4k4 Jan 27 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.