Can't get access control handler to be picked up

Here's how I defined a operation provider for gnode, which doesn't have one by default:

  group.relation_handler.operation_provider.group_node:
    class: 'Drupal\MYMODULE\Plugin\Group\RelationHandler\MYCLASSNAME'
    arguments: [ '@group.relation_handler.operation_provider', '@current_user', '@string_translation']
    shared: false

So you provide the default for parent, not inner. the inner stuff is when you decorate an existing service. That said, you likely don't want to decorate even then, because that assumes you want to extend what it does, when it's more likely that you want to replace it anyway.

To replace an existing definition, you switch the class in a service provider alter:

    if ($container->has('group.relation_handler.operation_provider.group_media')) {
      $definition = $container->getDefinition('group.relation_handler.operation_provider.group_media');
      $definition->setClass(MyCLassName::class);
    }

If you have different constructor arguments, you might need to alter that as well.

Just throwing this in here for now, we should improve https://www.drupal.org/node/3222292 → to document that there.

Thanks Berdir. I have switched the class in a service alterer, and I can see with a debugger that my alteration is executed:

namespace Drupal\pod;

use Drupal\Core\DependencyInjection\ContainerBuilder;
use Drupal\Core\DependencyInjection\ServiceProviderBase;
use Drupal\pod\Plugin\Group\RelationHandler\PodAccessControl;

/**
 * Modifies the language manager service.
 */
class PodServiceProvider extends ServiceProviderBase {

  /**
   * {@inheritdoc}
   */
  public function alter(ContainerBuilder $container) {
    if ($container->has('group.relation_handler.access_control.group_content_menu')) {
      $definition = $container->getDefinition('group.relation_handler.access_control.group_content_menu');
      $definition->setClass(PodAccessControl::class);
    }

  }

}

However, my PodAccessControl class is never even accessed (again, using a debugger), even though I can see the group content menu on the page.

Adding a debug breakpoint to this line: https://git.drupalcode.org/project/group/-/blame/3.0.x/src/GroupServiceP...

I can see that the callback class for the service is listed as "Drupal\group\Plugin\Group\RelationHandler\EmptyAccessControl". Also, this is only ever called on cache clear (not when accessing the group), and that this code is called BEFORE my container alter service class is invoked, which is why my class is not picked up.

Any ideas?

I have a custom daterange field for the relations user <-> group and node <-> group. A custom module only grants access to group nodes if both dateranges include todays date. Like this, we can provide time restricted access to dynamic content.

I was using a hook_content_info_alter to add a custom access handler class. For 2.0 compatibility, I had to change that and after a lot of headache, I got it running with a service decorator like described here: https://gist.github.com/adamfranco/5814eba660cbda3c93b5253b28b325ab

I am only changing the access handler for the 'view' operation. Everything else is handled via the existing functionality (roles etc.).

Am I right that in this case, a decoration like the example in the link above is the correct way to go?