Access Control and Permissions in Code

<?php

declare(strict_types=1);

namespace Drupal\meridian_collection;

use Drupal\Core\DependencyInjection\AutowireTrait;
use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
use Drupal\Core\Entity\BundlePermissionHandlerTrait;
use Drupal\Core\Entity\EntityTypeManagerInterface;
use Drupal\Core\StringTranslation\StringTranslationTrait;
use Drupal\node\NodeTypeInterface;

/**
 * Generates one "feature on the kiosk" permission per content type.
 */
final class FeaturedPermissions implements ContainerInjectionInterface {

  use AutowireTrait;
  use BundlePermissionHandlerTrait;
  use StringTranslationTrait;

  public function __construct(
    private readonly EntityTypeManagerInterface $entityTypeManager,
  ) {}

  /**
   * Returns the permissions, keyed by machine name.
   *
   * @return array<string, array<string, mixed>>
   */
  public function permissions(): array {
    $types = $this->entityTypeManager->getStorage('node_type')->loadMultiple();
    return $this->generatePermissions($types, $this->buildPermissions(...));
  }

  /**
   * Builds the permissions of one content type.
   */
  protected function buildPermissions(NodeTypeInterface $type): array {
    $id = $type->id();
    $args = ['%type' => $type->label()];
    return [
      "feature $id content on kiosk" => [
        'title' => $this->t('%type: Feature content on the gallery kiosk', $args),
        'description' => $this->t('Lets editors pin %type content to the kiosk home screen.', $args),
      ],
    ];
  }

}

<?php

declare(strict_types=1);

namespace Drupal\meridian_collection\Access;

use Drupal\Component\Datetime\TimeInterface;
use Drupal\Core\Access\AccessInterface;
use Drupal\Core\Access\AccessResult;
use Drupal\Core\Access\AccessResultInterface;
use Drupal\Core\Session\AccountInterface;
use Drupal\meridian_collection\Entity\CollectionObjectInterface;

/**
 * Hides embargoed collection objects from accounts without the permission.
 */
final class EmbargoAccessCheck implements AccessInterface {

  public function __construct(private readonly TimeInterface $time) {}

  /**
   * Checks access for the _meridian_embargo requirement.
   */
  public function access(AccountInterface $account, CollectionObjectInterface $collection_object): AccessResultInterface {
    $until = $collection_object->getEmbargoUntil();
    $now = $this->time->getRequestTime();

    if ($until === NULL || $until <= $now) {
      // No embargo, or it has expired: no opinion about the object itself.
      $result = AccessResult::allowed();
    }
    else {
      $result = AccessResult::allowedIfHasPermission($account, 'view embargoed collection objects');
      // The answer flips when the embargo ends, even if nothing is saved.
      $result->setCacheMaxAge($until - $now);
    }

    // Saving the object (a new embargo date) invalidates the cached answer.
    return $result->addCacheableDependency($collection_object);
  }

}

# meridian_collection.services.yml
services:
  meridian_collection.access.embargo:
    class: Drupal\meridian_collection\Access\EmbargoAccessCheck
    autowire: true
    tags:
      - { name: access_check, applies_to: _meridian_embargo }

$url = Url::fromRoute('meridian_collection.curator_dashboard');
// Returns a boolean by default; pass TRUE as the second argument for the AccessResult.
$result = $url->access($this->currentUser, TRUE);
$build['link'] = Link::fromTextAndUrl($this->t('Curate'), $url)->toRenderable();
$build['link']['#access'] = $result;

<?php

declare(strict_types=1);

namespace Drupal\meridian_collection\Hook;

use Drupal\Core\Access\AccessResult;
use Drupal\Core\Access\AccessResultInterface;
use Drupal\Core\Field\FieldDefinitionInterface;
use Drupal\Core\Field\FieldItemListInterface;
use Drupal\Core\Hook\Attribute\Hook;
use Drupal\Core\Session\AccountInterface;
use Drupal\node\NodeInterface;

/**
 * Access rules contributed by the Meridian collection module.
 */
final class AccessHooks {

  /**
   * Published exhibitions must be unpublished before they can be deleted.
   */
  #[Hook('node_access')]
  public function nodeAccess(NodeInterface $node, string $op, AccountInterface $account): AccessResultInterface {
    if ($node->bundle() !== 'exhibition' || $op !== 'delete') {
      return AccessResult::neutral();
    }
    $blocked = $node->isPublished() && !$account->hasPermission('administer nodes');
    return AccessResult::forbiddenIf($blocked, 'Unpublish the exhibition before deleting it.')
      ->addCacheableDependency($node)
      ->cachePerPermissions();
  }

  /**
   * Only holders of the valuation permission may see or edit the valuation.
   */
  #[Hook('entity_field_access')]
  public function fieldAccess(string $operation, FieldDefinitionInterface $field_definition, AccountInterface $account, ?FieldItemListInterface $items = NULL): AccessResultInterface {
    if ($field_definition->getTargetEntityTypeId() !== 'collection_object' || $field_definition->getName() !== 'valuation') {
      return AccessResult::neutral();
    }
    // Fields are allowed by default, so withholding needs an explicit veto.
    return AccessResult::forbiddenIf(!$account->hasPermission('view object valuation'))
      ->cachePerPermissions();
  }

}

// Listing for a visitor: only what the current user may view.
$ids = $this->entityTypeManager->getStorage('collection_object')
  ->getQuery()
  ->accessCheck(TRUE)
  ->condition('on_display', 1)
  ->sort('accession_number')
  ->execute();

// A background job that processes every record regardless of who is logged in.
$ids = $this->entityTypeManager->getStorage('collection_object')
  ->getQuery()
  ->accessCheck(FALSE)
  ->condition('on_display', 1)
  ->execute();

<?php

declare(strict_types=1);

namespace Drupal\meridian_collection\Access;

use Drupal\Core\Config\ConfigFactoryInterface;
use Drupal\Core\Session\AccessPolicyBase;
use Drupal\Core\Session\AccountInterface;
use Drupal\Core\Session\CalculatedPermissionsItem;
use Drupal\Core\Session\RefinableCalculatedPermissionsInterface;

/**
 * Grants curators the loan-management permission during the loan season.
 */
final class LoanSeasonAccessPolicy extends AccessPolicyBase {

  public function __construct(private readonly ConfigFactoryInterface $configFactory) {}

  /**
   * {@inheritdoc}
   */
  public function calculatePermissions(AccountInterface $account, string $scope): RefinableCalculatedPermissionsInterface {
    // AccessPolicyBase adds the persistent contexts to the new object.
    $calculated = parent::calculatePermissions($account, $scope);

    $settings = $this->configFactory->get('meridian_collection.settings');
    // Whenever the flag changes, the cached result is rebuilt.
    $calculated->addCacheableDependency($settings);

    if (!$settings->get('loan_season') || !in_array('curator', $account->getRoles(), TRUE)) {
      return $calculated;
    }
    return $calculated->addItem(new CalculatedPermissionsItem(['manage object loans']));
  }

  /**
   * {@inheritdoc}
   */
  public function getPersistentCacheContexts(): array {
    // The result varies by the roles of the account, never by user.permissions.
    return ['user.roles'];
  }

}

# meridian_collection.services.yml
services:
  meridian_collection.loan_season_access_policy:
    class: Drupal\meridian_collection\Access\LoanSeasonAccessPolicy
    autowire: true
    tags:
      - { name: access_policy }

<?php

declare(strict_types=1);

namespace Drupal\meridian_collection\Access;

use Drupal\Core\Config\ConfigFactoryInterface;
use Drupal\Core\Session\AccessPolicyBase;
use Drupal\Core\Session\AccountInterface;
use Drupal\Core\Session\CalculatedPermissionsItem;
use Drupal\Core\Session\RefinableCalculatedPermissionsInterface;

/**
 * Removes the editing permissions while the collection is frozen.
 */
final class CollectionFreezeAccessPolicy extends AccessPolicyBase {

  private const REVOKED = ['edit collection objects', 'delete collection objects', 'create collection objects'];

  public function __construct(private readonly ConfigFactoryInterface $configFactory) {}

  /**
   * {@inheritdoc}
   */
  public function alterPermissions(AccountInterface $account, string $scope, RefinableCalculatedPermissionsInterface $calculated_permissions): void {
    $settings = $this->configFactory->get('meridian_collection.settings');
    // Declare the dependency even when the freeze is off, so switching it on is seen.
    $calculated_permissions->addCacheableDependency($settings);
    if (!$settings->get('collection_frozen')) {
      return;
    }

    foreach ($calculated_permissions->getItems() as $item) {
      if ($item->isAdmin() || $item->getScope() !== $scope) {
        // Administrators keep everything, otherwise nobody could end the freeze.
        continue;
      }
      $remaining = array_diff($item->getPermissions(), self::REVOKED);
      $calculated_permissions->addItem(
        new CalculatedPermissionsItem($remaining, FALSE, $item->getScope(), $item->getIdentifier()),
        TRUE,
      );
    }
  }

}

<?php

declare(strict_types=1);

namespace Drupal\Tests\meridian_collection\Kernel;

use Drupal\KernelTests\KernelTestBase;
use Drupal\user\Entity\Role;
use Drupal\user\Entity\User;
use PHPUnit\Framework\Attributes\Group;
use PHPUnit\Framework\Attributes\RunTestsInSeparateProcesses;

/**
 * Tests the seasonal loan permission and the collection freeze.
 */
#[Group('meridian_collection')]
#[RunTestsInSeparateProcesses]
final class AccessPolicyTest extends KernelTestBase {

  protected static $modules = ['system', 'user', 'meridian_collection'];

  protected function setUp(): void {
    parent::setUp();
    $this->installEntitySchema('user');
    $this->installEntitySchema('collection_object');
    $this->installConfig(['meridian_collection']);
    Role::create(['id' => 'curator', 'label' => 'Curator', 'permissions' => ['edit collection objects']])->save();
  }

  public function testLoanSeasonGrantsLoanPermission(): void {
    $curator = User::create(['name' => 'curator1', 'status' => 1, 'roles' => ['curator']]);
    $curator->save();

    $this->assertFalse($curator->hasPermission('manage object loans'));

    $this->config('meridian_collection.settings')->set('loan_season', TRUE)->save();
    $this->assertTrue($curator->hasPermission('manage object loans'));
  }

  public function testFreezeRevokesEditing(): void {
    $curator = User::create(['name' => 'curator2', 'status' => 1, 'roles' => ['curator']]);
    $curator->save();
    $this->assertTrue($curator->hasPermission('edit collection objects'));

    $this->config('meridian_collection.settings')->set('collection_frozen', TRUE)->save();
    $this->assertFalse($curator->hasPermission('edit collection objects'));
  }

}

ddev exec vendor/bin/phpunit -c web/core web/modules/custom/meridian_collection/tests/src/Kernel