Content missing from views when using multiple ignore empty behavior

Created on 30 January 2024, 5 months ago
Updated 31 January 2024, 5 months ago

Problem/Motivation

I'm facing an issue with all views that used for content types that have access policy applied on them. All nodes didn't appear in the views but I can access all of them from the node page.

Steps to reproduce

1- Create article content type.
2- Add department field which is entity reference to the article content type and user.
3- Add location field which is entity reference to the article content type and user.
4- Create a new access policy called employee policy, and add "compare department with user" rule to match the value between the user and the node, and set empty behavior to be ignore. Set the validation operator to be any.
5- Add "compare location with user" rule to employee policy.
6- Create an user with department x and location y.
7- Create an article without filling the department and location fields.
8- Create a view to list all articles, and place it on the homepage.
9- Login using the new created user and open the homepage.
10- You will notice that the new article didn't appear, and you can open the node page using direct url to it.

Proposed resolution

I think the problem in query alter functionality, because the node page is accessible and the issue only in views.

Remaining tasks

User interface changes

API changes

Data model changes

πŸ› Bug report
Status

Active

Version

1.0

Component

Code

Created by

πŸ‡―πŸ‡΄Jordan Odai Atieh Amman

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @Odai Atieh
  • πŸ‡―πŸ‡΄Jordan Odai Atieh Amman
  • πŸ‡―πŸ‡΄Jordan Odai Atieh Amman
  • πŸ‡―πŸ‡΄Jordan Odai Atieh Amman
  • πŸ‡ΊπŸ‡ΈUnited States partdigital

    Hi Odai,

    This sounds relatively similar to a fix that was pushed last week. Does it still happen if you upgrade to the latest dev version?

  • πŸ‡―πŸ‡΄Jordan Odai Atieh Amman

    Hi Joshua,

    I've upgraded the module to dev, but I'm facing another issue, now I can't see all needed rules for all fields. I just can find 2 of them.

    Is there any change should I do before adding them?

  • πŸ‡―πŸ‡΄Jordan Odai Atieh Amman

    Also, I checked your commit here https://git.drupalcode.org/project/access_policy/-/commit/4685b80fe83f3b... but it didn't work.

  • πŸ‡ΊπŸ‡ΈUnited States partdigital

    I've upgraded the module to dev, but I'm facing another issue, now I can't see all needed rules for all fields. I just can find 2 of them.

    I pushed up a change in beta6 that limited entity reference access rules to only fields that configured identically. For example, the Department taxonomy term field needs to have the same bundles selected for both the user and node fields. I added this in because it was adding a lot of fields that didn't do anything otherwise. Did you take a look at your entity reference fields to make sure they had the same bundles selected?

    The ignore issue will require some more investigation. In the meantime there are a few workarounds that you can try.

    • Break up your access rules across two access policies and group them into a Selection set. This allows you to assign two policies at the same time using OR logic. This is will have the same effect and should resolve the issue.
      • You can create your own AccessRuleQueryHandler and modify the query.

    For example, you can modify the annotation of the access rule and replace it with your own handler.

    
    function mymodule_access_rule_alter(&$definitions). {
      $definitions['entity_field_entity_reference']['handlers']['query_alter'] = '\Drupal\mymodule\AccessRuleQueryHandler\MyQueryHandler';
    }
    
  • πŸ‡ΊπŸ‡ΈUnited States partdigital
  • πŸ‡―πŸ‡΄Jordan Odai Atieh Amman

    Did you take a look at your entity reference fields to make sure they had the same bundles selected?

    Yes, but for the node fields I used "filter by an entity reference view" to apply some restrictions so I think this breaks the rules in the access policy.

    You can create your own AccessRuleQueryHandler and modify the query.

    I've tried to add some changes to queryIgnoreEmpty to add or group to get all entities that have the rules field empty, but it didn't work. I'll check AccessRuleQueryHandler as you recommended.

  • πŸ‡―πŸ‡΄Jordan Odai Atieh Amman

    Break up your access rules across two access policies and group them into a Selection set. This allows you to assign two policies at the same time using OR logic. This will have the same effect and should resolve the issue.

    I've tried the above suggestion, but didn't work. E.g. in case I selected department x and the location field was empty for a node, and the user was not in department x, then the node will be accessible. I think this is happened because the location field in the node was empty and the location rule was set to ignore empty values. which will add the user's locations to the query and allow empty value. So, the location policy will allow the user to access the node.

  • πŸ‡ΊπŸ‡ΈUnited States partdigital

    Did you try something like this?

    Department policy

    • Access rule: Department taxonomy term, empty value is set to deny
    • Selection rule: Department field is not empty
    • Selection set: Restricted

    Location policy

    • Access rule: Location taxonomy term, empty value is set to deny
    • Selection rule: Location field is not empty
    • Selection set: Restricted

    If no value is provided for the Location field or the Department field it won’t assign any policy and it will be accessible to everyone.

    Yes, but for the node fields I used "filter by an entity reference view" to apply some restrictions so I think this breaks the rules in the access policy.

    I've been able to reproduce this and will open a new ticket to address it.

  • πŸ‡―πŸ‡΄Jordan Odai Atieh Amman

    If no value is provided for the Location field or the Department field it won’t assign any policy and it will be accessible to everyone.

    Did you mean that if the location field or the department field is empty in the node or the user profile? because I'm talking about case if the fields were empty in the node not in the user profile.

    and I'll try the suggested polices.

Production build 0.69.0 2024