Actual file permisions

Question

With Drupal 8/9 I want to:

1. Have a private file folder
2. Upload files to it (ideally by whatever method but media type will do)
3. Allow only authenticated users (ideally set by role) to view the file (whether by direct link or link in WYSIWYG editor)

Why does this seem to be so hard? Am I missing something?

When I set up private files using the online documentation I can find it either blocks everyone but the Admin from seeing the direct link or allows anonymous users to view the link even if the private files folder is outside the webroot. There seems to be no fine-grained control of permissions.

Answer 1

Drupal terminology can be confusing.

In Drupal core, "public" files mean "open to the public at a publicly accessible URL". With public files, visitors can download the original file and you have no control over that, as the file is made publicly accessible via the webserver.

With "private" files, Drupal itself handles the serving of the files, which means that the files are not available via a webserver URL; instead, Drupal serves the files. This doesn't have anything to do with permissions or keeping files private from some users; it means keeping files private vs. the web itself.

How to add permissions to files

You can use the Private Files Download Permission module. There's a basic tutorial to get you started.