function hook_jsonapi_entity_field_filter_access

Restricts filtering access to the given field.

Some fields may contain sensitive information. In these cases, modules are supposed to implement hook_entity_field_access(). However, this hook receives an optional `$items` argument and often must return AccessResult::neutral() when `$items === NULL`. This is because access may or may not be allowed based on the field items or based on the entity on which the field is attached (if the user is the entity owner, for example).

Since JSON:API must check field access prior to having a field item list instance available (access must be checked before a database query is made), it is not sufficiently secure to check field 'view' access alone.

This hook exists so that modules which cannot return AccessResult::forbidden() from hook_entity_field_access() can still secure JSON:API requests where necessary.

If a corresponding implementation of hook_entity_field_access() *can* be forbidden for one or more values of the `$items` argument, this hook *MUST* return AccessResult::forbidden().

Parameters

\Drupal\Core\Field\FieldDefinitionInterface $field_definition: The field definition of the field to be filtered upon.

\Drupal\Core\Session\AccountInterface $account: The account for which to check access.

Return value

\Drupal\Core\Access\AccessResultInterface The access result.

Related topics

File

core/modules/jsonapi/jsonapi.api.php, line 341

Documentation related to JSON:API.

Code

function hook_jsonapi_entity_field_filter_access(\Drupal\Core\Field\FieldDefinitionInterface $field_definition, \Drupal\Core\Session\AccountInterface $account) {
  if ($field_definition
    ->getTargetEntityTypeId() === 'node' && $field_definition
    ->getName() === 'field_sensitive_data') {
    $has_sufficient_access = FALSE;
    foreach ([
      'administer nodes',
      'view all sensitive field data',
    ] as $permission) {
      $has_sufficient_access = $has_sufficient_access ?: $account
        ->hasPermission($permission);
    }
    return AccessResult::forbiddenIf(!$has_sufficient_access)
      ->cachePerPermissions();
  }
  return AccessResult::neutral();
}