user_access_test.module

<?php

/**
 * @file
 * Dummy module implementing hook_user_access() to test if entity access is respected.
 */
use Drupal\Core\Access\AccessResult;
use Drupal\Core\Field\FieldDefinitionInterface;
use Drupal\Core\Field\FieldItemListInterface;
use Drupal\Core\Session\AccountInterface;
use Drupal\user\Entity\User;

/**
 * Implements hook_ENTITY_TYPE_access() for entity type "user".
 */
function user_access_test_user_access(User $entity, $operation, $account) {
  if ($entity
    ->getAccountName() == "no_edit" && $operation == "update") {

    // Deny edit access.
    return AccessResult::forbidden();
  }
  if ($entity
    ->getAccountName() == "no_delete" && $operation == "delete") {

    // Deny delete access.
    return AccessResult::forbidden();
  }

  // Account with role sub-admin can manage users with no roles.
  if (count($entity
    ->getRoles()) == 1) {
    return AccessResult::allowedIfHasPermission($account, 'sub-admin');
  }
  return AccessResult::neutral();
}

/**
 * Implements hook_entity_create_access().
 */
function user_access_test_entity_create_access(AccountInterface $account, array $context, $entity_bundle) {
  if ($context['entity_type_id'] != 'user') {
    return AccessResult::neutral();
  }

  // Account with role sub-admin can create users.
  return AccessResult::allowedIfHasPermission($account, 'sub-admin');
}

/**
 * Implements hook_entity_field_access().
 */
function user_access_test_entity_field_access($operation, FieldDefinitionInterface $field_definition, AccountInterface $account, FieldItemListInterface $items = NULL) {

  // Account with role sub-admin can view the status, init and mail fields for
  // user with no roles.
  if ($field_definition
    ->getTargetEntityTypeId() == 'user' && $operation === 'view' && in_array($field_definition
    ->getName(), [
    'status',
    'init',
    'mail',
  ])) {
    if ($items == NULL || count($items
      ->getEntity()
      ->getRoles()) == 1) {
      return AccessResult::allowedIfHasPermission($account, 'sub-admin');
    }
  }
  if (\Drupal::state()
    ->get('user_access_test_forbid_mail_edit', FALSE)) {
    if ($operation === 'edit' && $items && $items
      ->getEntity()
      ->getEntityTypeId() === 'user' && $field_definition
      ->getName() === 'mail') {
      return AccessResult::forbidden();
    }
  }
  return AccessResult::neutral();
}