Entity query on custom entity is not checking access rights

Question

I have a custom entity called project_member. Not all user have access to this entity. But when I query this entity with entityQuery as follows \Drupal::entityQuery('project_member')->execute() all the entities are returning. It is not checking the access rights. I am missing anything. I tried to implement hook_project_member_access() to restrict the access still entityQuery is not checking those access results.

Answer 1

You will need to implement hook_query_ENTITY_TYPE_access_alter ( hook_query_project_member_access_alter) to apply the custom query access check.

For example https://api.drupal.org/api/drupal/core%21modules%21node%21node.module/function/node_query_node_access_alter/8.9.x

You might need to $query->addTag(‘project_member_access’) but from memory that tag may now be added automatically by the entity query handler.

Answer 2

If I'm not mistaken, entity queries will respect access if you've got the appropriate access tag on the query, which you may or may not be defining. I haven't dug much into how to implement this as custom entities, but the node module defines the node_access query tag that's automatically applied to all node entity queries (I believe), so that would be a good place to start looking.

https://api.drupal.org/api/drupal/core%21modules%21node%21node.module/group/node_access/8.9.x