function field_permission_example_entity_field_access

Implements hook_entity_field_access().

We want to make sure that fields aren't being seen or edited by those who shouldn't.

Related topics

File

modules/field_permission_example/field_permission_example.module, line 96

Code

function field_permission_example_entity_field_access($operation, FieldDefinitionInterface $field_definition, AccountInterface $account, FieldItemListInterface $items = NULL) {
    $messenger = \Drupal::messenger();
    // Find out what field we're looking at.  If it isn't
    // our sticky note widget, tell Drupal we don't care about its access.
    if ($field_definition->getType() != 'field_permission_example_fieldnote') {
        return AccessResult::neutral();
    }
    // First we'll check if the user has the 'superuser'
    // permissions that node provides. This way administrators
    // will be able to administer the content types.
    if ($account->hasPermission('bypass node access')) {
        $messenger->addMessage(t('User can bypass node access.'));
        return AccessResult::allowed();
    }
    if ($account->hasPermission('administer content types', $account)) {
        $messenger->addMessage(t('User can administer content types.'));
        return AccessResult::allowed();
    }
    if ($account->hasPermission('administer the fieldnote field', $account)) {
        $messenger->addMessage(t('User can administer this field.'));
        return AccessResult::allowed();
    }
    // For anyone else, it depends on the desired operation.
    if ($operation == 'view' and $account->hasPermission('view any fieldnote')) {
        $messenger->addMessage(t('User can view any field note.'));
        return AccessResult::allowed();
    }
    if ($operation == 'edit' and $account->hasPermission('edit any fieldnote')) {
        $messenger->addMessage(t('User can edit any field note.'));
        return AccessResult::allowed();
    }
    // At this point, we need to know if the user "owns" the entity we're attached
    // to. If it's a user, we'll use the account name to test. Otherwise rely on
    // the entity implementing the EntityOwnerInterface. Anything else can't be
    // owned, and we'll refuse access.
    if ($items) {
        $entity = $items->getEntity();
        if ($entity instanceof EntityOwnerInterface and $entity->getOwner()
            ->getAccountName() == $account->getAccountName() or $entity instanceof UserInterface and $entity->name->value == $account->getAccountName()) {
            if ($operation == 'view' and $account->hasPermission('view own fieldnote')) {
                $messenger->addMessage(t('User can view their own field note.'));
                return AccessResult::allowed();
            }
            if ($operation == 'edit' and $account->hasPermission('edit own fieldnote')) {
                $messenger->addMessage(t('User can edit their own field note.'));
                return AccessResult::allowed();
            }
        }
    }
    // Anything else on this field is forbidden.
    return AccessResult::forbidden();
}