Code that is put in either hook_entity_access or an access handler has no effect on listings such as views field displays and search. I am not sure if this is by design or due to an error from my side, but my guess is that the db queries don't have a way to factor in the generated then cached access results.

This bit I mean:

return AccessResult::forbidden()->cachePerPermissions()->cachePerUser()->addCacheableDependency($stuff);

Is there a way to factor it in listings? If not how should I go about applying the same logic in hook_entity_access or access handlers to listings?

  • Can you see a relevant cache context in the X-Drupal-Cache-Contexts response header for the listing? You may also be able to alter the views query to apply access control.( api.drupal.org/api/drupal/… ) That way you could vary the result and cache context for the user. Jan 7, 2021 at 9:53
  • I haven't had e a use for this before. Are these the ones listed under the main document/page? Query can do it, yes. Is that different from using entity queryAccess handler?
    – Jed_BH
    Jan 8, 2021 at 22:10
  • Entity queries don't have a way to pass cache metadata. They just bubble it up, which is OK when used in a render context but can cause problems when not. See drupal.stackexchange.com/questions/251864/…
    – 4uk4
    Jan 24, 2021 at 10:53
  • Is the better solution then to save the calculated access results to DB and alter queries to reflect the correct outcome? 4k4 is this more related to this drupal.org/project/drupal/issues/2876258
    – Jed_BH
    Jan 27, 2021 at 6:57
  • The solution you describe is basically how Drupal implements node grants saving the access results in the table node_access and altering the node query in node_query_node_access_alter.
    – 4uk4
    Jan 27, 2021 at 8:40


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.