function EntityAccessControlHandler::fieldAccess

Overrides EntityAccessControlHandlerInterface::fieldAccess

File

core/lib/Drupal/Core/Entity/EntityAccessControlHandler.php, line 312

Class

EntityAccessControlHandler

Defines a default implementation for entity access control handler.

Namespace

Code

public function fieldAccess($operation, FieldDefinitionInterface $field_definition, AccountInterface $account = NULL, FieldItemListInterface $items = NULL, $return_as_object = FALSE) {
    $account = $this->prepareUser($account);
    // Get the default access restriction that lives within this field.
    $default = $items ? $items->defaultAccess($operation, $account) : AccessResult::allowed();
    // Explicitly disallow changing the entity ID and entity UUID.
    $entity = $items ? $items->getEntity() : NULL;
    if ($operation === 'edit' && $entity) {
        if ($field_definition->getName() === $this->entityType
            ->getKey('id')) {
            // String IDs can be set when creating the entity.
            if (!($entity->isNew() && $field_definition->getType() === 'string')) {
                return $return_as_object ? AccessResult::forbidden('The entity ID cannot be changed.')->addCacheableDependency($entity) : FALSE;
            }
        }
        elseif ($field_definition->getName() === $this->entityType
            ->getKey('uuid')) {
            // UUIDs can be set when creating an entity.
            if (!$entity->isNew()) {
                return $return_as_object ? AccessResult::forbidden('The entity UUID cannot be changed.')->addCacheableDependency($entity) : FALSE;
            }
        }
    }
    // Get the default access restriction as specified by the access control
    // handler.
    $entity_default = $this->checkFieldAccess($operation, $field_definition, $account, $items);
    // Combine default access, denying access wins.
    $default = $default->andIf($entity_default);
    // Invoke hook and collect grants/denies for field access from other
    // modules. Our default access flag is masked under the ':default' key.
    $grants = [
        ':default' => $default,
    ];
    $hook_implementations = $this->moduleHandler()
        ->getImplementations('entity_field_access');
    foreach ($hook_implementations as $module) {
        $grants = array_merge($grants, [
            $module => $this->moduleHandler()
                ->invoke($module, 'entity_field_access', [
                $operation,
                $field_definition,
                $account,
                $items,
            ]),
        ]);
    }
    // Also allow modules to alter the returned grants/denies.
    $context = [
        'operation' => $operation,
        'field_definition' => $field_definition,
        'items' => $items,
        'account' => $account,
    ];
    $this->moduleHandler()
        ->alter('entity_field_access', $grants, $context);
    $result = $this->processAccessHookResults($grants);
    return $return_as_object ? $result : $result->isAllowed();
}