I have a site where I work with main users and sub users (users created by a main user). Using permissions I allow these users to edit other users nodes.

Using a script inside hook_node_access I make sure access is only allowed for users that are related to each other.

The stripped version of my code looks something like:

hook_node_access(NodeInterface $node, $op, $account){
  if ($op == 'update') {
    $uids = [1,2,3,4] //array of user ids related to each other

    // when node author is not in user id array...forbid access
    return AccessResult::forbiddenIf(!in_array($account->id(), $uids))->cachePerUser()->addCacheableDependency($node);

This works but when a none author tries to edit a unpublished node I get an error. The path 'node/x' is either invalid or you do not have access to it.

What can I do to give a none author update access to a unpublished node?

  • Shouldn't the code in the last line not check against $account->id(). Otherwise ->cachePerUser() is not applicable and the entire code doesn't make much sense. About the second question. What are none authors and do they have access without the custom code only by their roles and permissions?
    – 4uk4
    Commented Jun 22, 2022 at 12:52
  • I think in the end it is working exactly the same but your suggestion of using $account->id() is better code wise. I changed it. A none author is not the author of a node. But is related to the author of the node. All users have acces to everything without the custom code. The custom code is making sure all not related users don't have access.
    – Joost
    Commented Jun 22, 2022 at 13:17

1 Answer 1


I discovered that having problems with updating the node is caused by restrictions in viewing the node. Because users are not able to view unpublished nodes of other users it was not possible to update them for some reason.

I changed the view access for these users so they are able to view unpublished nodes of other users and now updating the nodes is possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.