ECA Access: Do not set AccessResult in applies()

Created on 5 April 2024, 3 months ago
Updated 12 June 2024, 16 days ago

Problem/Motivation

In ✨ Use case: Complex access control based on workflow state Active , we describe how we want to deny all access to certain fields in one model, and then selectively grant access to those fields only during specific workflow states. The plugin created to satisfy that use-case relies on the patch in 📌 Make it easier to extend existing plugins Active , which allows it to inherit from the FieldAccess plugin. We then add fields to the Event config form to allow us to specify in which workflow states the Event should apply.

This works quite nicely, except that any event that applies to one of these fields returns an AccessResultNeutral, even if the workflow state doesn't apply. This appears to be due to calling parent::applies() from our plugin, which eventually hits EntityAccess::applies() where we see:

// Initialize with a neutral result.
$this->accessResult = AccessResult::neutral();

As a work-around, we had to deny access unconditionally again, as the first successor to all of our events. We traced this back to the above line of code. Commenting it out resolves the issue for us.

AFAICT it is not required, since we return a neutral result as a fallback in the all implementations of hook_entity_field_access().

Proposed resolution

Do not set an AccessResult in applies(). That is, just remove the problematic line.

Remaining tasks

  1. Provide a patch against 1.1.x branch
  2. Create an MR from the 2.0.x branch
📌 Task
Status

Postponed

Version

2.1

Component

Code

Created by

🇨🇦Canada ergonlogic Montréal, Québec 🇨🇦

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.69.0 2024