Hi,
I have a use case where I'm migrating more than 10 years of content and it's images to Drupal which are on the same S3 bucket as the Drupal is using but in other directories outside s3file-public.
So we built an API to receive and create the content on Drupal. The API creates a file entity with the URI pointing to s3://something/old-picture.jpg and then filling the image field on the content it self (field_image).
But when the content is being validated before it saves the entity access enters and there's nothing that allows access for the file entity to be referenced on a content.
After some digging I found out the root cause. The /core/modules/file/src/FileAccessControlHandler.php checks four things:
- uri scheme is "public"
- the file entity already is being referenced by other content besides the one being created at that time
- the file owner is the same as the current user
- only the file owner can delete and update the file entity.
and in case none fo them are valid, the access result is neutral, which means that the resulted access is $result->isAllowed() = FALSE and thats why I get the "You do not have access to the referenced entity file." error message.
To solve this issue I think we have two options:
- Override the File entity control handler to use one which S3 owns and extends from FileAccessControlHandler class.
- Use a simple hook_ENTITY_TYPE_access() and add the missing code.
Since I have to deliver a solution right now, I implemented the second option, using the access hook, but I have doubts about how we should check for permissions, etc...
Any thoughts on this would be very welcome :)
Cheers!