Add a search api processor for view unpublished

Created on 4 April 2018, over 7 years ago
Updated 30 January 2025, 11 months ago

Problem

There is an open discussion about how search api handles access. One of the reported problems is that it does not work view_unpublished. The content access search api processor does not respect view_unpublished permissions and if a user with view unpublished content permission is unable to view unpublished nodes/content in the search result.In the discussion the module maintainer suggest that other modules build their own. https://www.drupal.org/project/search_api/issues/1617794 β†’

Proposed Solution

Add a search_api plugin that allow for choosing a processor that supports view_unpublished. (See screenshot).In this processor we check for appropriate permissions.

Usage

  1. Apply patch
  2. Make sure search api enabled
  3. go to admin/config/search/search-api/index/default_index/processors
  4. Check the box Content Access: View unpublished. Also ensure the Content Access is not checked (see screen shot below)

Patch attached below. It reuse the same addNodeAccess method defined by ContentAcess in the search_api module but removed the code where unpublished content is filtered out namely:

    // Collect all the required fields that need to be part of the index.
    $unpublished_own = $account->hasPermission('view own unpublished content');

    $enabled_conditions = $query->createConditionGroup('OR', ['content_access_enabled']);
    foreach ($affected_datasources as $entity_type => $datasources) {
      foreach ($datasources as $datasource_id) {
        // If this is a comment datasource, or users cannot view their own
        // unpublished nodes, a simple filter on "status" is enough. Otherwise,
        // it's a bit more complicated.
        $status_field = $this->findField($datasource_id, 'status', 'boolean');
        if ($status_field) {
          $enabled_conditions->addCondition($status_field->getFieldIdentifier(), TRUE);
        }
        if ($entity_type == 'node' && $unpublished_own) {
          $author_field = $this->findField($datasource_id, 'uid', 'integer');
          if ($author_field) {
            $enabled_conditions->addCondition($author_field->getFieldIdentifier(), $account->id());
          }
        }
      }
    }
    $access_conditions->addConditionGroup($enabled_conditions);
✨ Feature request
Status

Needs review

Version

1.0

Component

Code

Created by

πŸ‡ΊπŸ‡ΈUnited States awm

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024