function jsonapi_jsonapi_node_filter_access

Implements hook_jsonapi_ENTITY_TYPE_filter_access() for 'node'.

File

core/modules/jsonapi/jsonapi.module, line 239

Code

function jsonapi_jsonapi_node_filter_access(EntityTypeInterface $entity_type, AccountInterface $account) {
  // @see \Drupal\node\NodeAccessControlHandler::access()
  if ($account->hasPermission('bypass node access')) {
    return [
      JSONAPI_FILTER_AMONG_ALL => AccessResult::allowed()->cachePerPermissions(),
    ];
  }
  if (!$account->hasPermission('access content')) {
    $forbidden = AccessResult::forbidden("The 'access content' permission is required.")->cachePerPermissions();
    return [
      JSONAPI_FILTER_AMONG_ALL => $forbidden,
      JSONAPI_FILTER_AMONG_OWN => $forbidden,
      JSONAPI_FILTER_AMONG_PUBLISHED => $forbidden,
      // For legacy reasons, the Node entity type has a "status" key, so forbid
      // this subset as well, even though it has no semantic meaning.
JSONAPI_FILTER_AMONG_ENABLED => $forbidden,
    ];
  }
  return [
    // @see \Drupal\node\NodeAccessControlHandler::checkAccess()
JSONAPI_FILTER_AMONG_OWN => AccessResult::allowedIfHasPermission($account, 'view own unpublished content'),
    // @see \Drupal\node\NodeGrantDatabaseStorage::access()
    // Note that:
    // - This is just for the default grant. Other node access conditions are
    //   added via the 'node_access' query tag.
    // - Permissions were checked earlier in this function, so we must vary the
    //   cache by them.
JSONAPI_FILTER_AMONG_PUBLISHED => AccessResult::allowed()->cachePerPermissions(),
  ];
}