Contrib.social

Integrate Group access checks with Search API

Open on Drupal.org →
Created on 12 February 2021, almost 4 years ago
Updated 27 February 2024, 10 months ago

Problem/Motivation

Groups switched to a query alter approach in #3158301: Directly alter query for grouped entities to improve performance. → . This works for regular Drupal queries. However, when implementing more complicated pages with Search API and Facets, the result set includes content that is not accessible for the current user since Group only supports SQL-based queries.

Steps to reproduce

  1. Add a Search API index and index content that is not accessible to an anonymous user
  2. Enable 'Skip item access checks' in the Views Query settings.
  3. Perform search and see content in the search results.
  4. Clicking the item returns an 'Access denied' page.

Proposed resolution

Integrate Group access checks with Search API.

Remaining tasks

  1. Write a patch
  2. Review
  3. Commit

User interface changes

To be determined.

API changes

To be determined.

Data model changes

To be determined.

📌 Task
Status

Active

Version

1.0

Component

Code

Created by

🇳🇱Netherlands idebr

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • Comment about 1 year ago →
    🇨🇦Canada plousia

    Thirding, this is really a necessity for sites that use Groups and SearchAPI.

  • Comment 10 months ago →
    🇺🇸United States tyler.hastain Utah

    Fourthing. This is really needed! In our use case, we want to hide the facet's data that the user does not have permissions to. We believe that this is happening because the index itself is not tied to groups or its permissions.

    Example:

    -Article is in 2 separate groups.
    -User only has access to one of those groups.
    -User should be permitted to see the article and see it is in a group they have access to.
    -However, they should not see the other group they don't have access to that the article is in within the facet.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024