Add a host access handler

Created on 29 July 2024, 5 months ago
Updated 9 September 2024, 3 months ago

Problem/Motivation

Access logic is spread around fairly widely in the blossoming realms of registration and its submodules. Heavy weight logic is to be found in all of these places:
RegistrationAccessControlHandler
RegistrationSettingsAccessControlHandler
ManageRegistrationsAccessCheck
RegistrationManager::getRegistrantOptions()
RegistrationController
RegisterAccessCheck (and its override)

This gives us 2 problems:
(1) It's DRY and fragile
(2) It's hard(er) to custom and contrib code to modify

Proposed resolution

Create a HostAccessControlHandler, a sibling to HostEntityHandler. It will:
- have an opinion on 'register', 'administer registration', 'manage registration' and 'administer registration settings' operations.
- dispatch hook_registration_host_access() hooks to allow other code to have a say.

Remaining tasks

User interface changes

API changes

Data model changes

πŸ“Œ Task
Status

Needs review

Version

3.1

Component

Registration Core

Created by

πŸ‡¬πŸ‡§United Kingdom jonathanshaw Stroud, UK

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @jonathanshaw
  • πŸ‡ΊπŸ‡ΈUnited States john.oltman

    Excellent suggestion @jonathanshaw!

  • πŸ‡¬πŸ‡§United Kingdom jonathanshaw Stroud, UK
  • πŸ‡¬πŸ‡§United Kingdom jonathanshaw Stroud, UK

    Here is a rough demonstration of how this might work.

  • Status changed to Needs work 5 months ago
  • πŸ‡¬πŸ‡§United Kingdom jonathanshaw Stroud, UK
  • Pipeline finished with Failed
    5 months ago
    Total: 304s
    #242164
  • Pipeline finished with Failed
    5 months ago
    Total: 354s
    #242640
  • Pipeline finished with Failed
    5 months ago
    Total: 324s
    #242696
  • Pipeline finished with Failed
    5 months ago
    Total: 294s
    #242790
  • Pipeline finished with Failed
    5 months ago
    Total: 292s
    #242853
  • πŸ‡¬πŸ‡§United Kingdom jonathanshaw Stroud, UK

    This has a fair number of test failures. Before spending time debugging them it would help to:
    1. Have input on john.oltman on how this seems in general
    2. Get πŸ› Fix access cacheability Needs review committed

  • Status changed to Needs review 5 months ago
  • πŸ‡¬πŸ‡§United Kingdom jonathanshaw Stroud, UK
  • πŸ‡ΊπŸ‡ΈUnited States john.oltman

    Cacheability has been committed. Will give input on the approach later this week.

  • Pipeline finished with Failed
    3 months ago
    Total: 283s
    #294382
  • Pipeline finished with Failed
    3 months ago
    Total: 299s
    #294606
  • Pipeline finished with Failed
    3 months ago
    Total: 320s
    #294613
  • Pipeline finished with Failed
    3 months ago
    Total: 257s
    #298005
  • πŸ‡ΊπŸ‡ΈUnited States john.oltman

    Sorry for the delay, this is back on my radar for another look in the near future.

  • πŸ‡ΊπŸ‡ΈUnited States john.oltman

    I like the direction this is going. Let's decide if we're going to create a new service named "RegistrationAccessChecker" as mentioned in https://www.drupal.org/project/registration/issues/3464137 ✨ Make it possible to customise who can administer registrations Active . If we are, then instead of calling host_entity->access with administer related permission names in a few places, you'd call the new service; the host entity operations to keep in that case would be (renaming to singular to be operation minded and not permission sounding):

    view_registration
    update_registration
    delete_registration
    manage_settings
    register_self
    register_authenticated
    register_anonymous

    As far as retaining the ability for developers to customize "administer" rights (since there would not be administer operations) - if we do the new service, that service can implement an alter hook e.g. hook_registration_access_check.

  • πŸ‡ΊπŸ‡ΈUnited States john.oltman

    I updated the previous comment to fix the operation names. We do want plural here as a host has N registrations.

  • Pipeline finished with Failed
    3 months ago
    Total: 288s
    #302152
  • Pipeline finished with Failed
    3 months ago
    Total: 572s
    #302170
  • Pipeline finished with Failed
    3 months ago
    Total: 442s
    #303271
  • Pipeline finished with Failed
    2 months ago
    Total: 280s
    #303986
  • Pipeline finished with Success
    2 months ago
    Total: 370s
    #304008
  • Pipeline finished with Failed
    2 months ago
    Total: 348s
    #304050
  • Pipeline finished with Failed
    2 months ago
    Total: 446s
    #304058
  • Pipeline finished with Failed
    2 months ago
    Total: 331s
    #304115
  • Pipeline finished with Failed
    2 months ago
    Total: 426s
    #304118
  • Pipeline finished with Success
    2 months ago
    Total: 348s
    #304160
  • πŸ‡¬πŸ‡§United Kingdom jonathanshaw Stroud, UK

    This will need updating if ✨ Make it possible to customise who can administer registrations Active is committed first, or vice versa.

  • Pipeline finished with Success
    2 months ago
    Total: 328s
    #304200
  • πŸ‡ΊπŸ‡ΈUnited States john.oltman
  • πŸ‡ΊπŸ‡ΈUnited States john.oltman
  • πŸ‡ΊπŸ‡ΈUnited States john.oltman

    Committed #3464137 first

  • πŸ‡¬πŸ‡§United Kingdom jonathanshaw Stroud, UK

    I've addressed the impact of [##3464137], but we need test coverage for hook_registration_host_access().

  • Pipeline finished with Success
    2 months ago
    Total: 380s
    #305403
  • Pipeline finished with Success
    2 months ago
    Total: 373s
    #306692
  • Pipeline finished with Success
    2 months ago
    Total: 391s
    #306693
  • Pipeline finished with Canceled
    2 months ago
    Total: 127s
    #306696
  • Pipeline finished with Failed
    2 months ago
    Total: 542s
    #306697
  • Pipeline finished with Canceled
    2 months ago
    Total: 226s
    #306742
  • Pipeline finished with Failed
    2 months ago
    Total: 286s
    #306743
  • Pipeline finished with Success
    2 months ago
    Total: 375s
    #306754
  • πŸ‡¬πŸ‡§United Kingdom jonathanshaw Stroud, UK

    Finally I think this is ready.

  • πŸ‡ΊπŸ‡ΈUnited States john.oltman
  • πŸ‡ΊπŸ‡ΈUnited States john.oltman
  • πŸ‡ΊπŸ‡ΈUnited States john.oltman

    This is very close to being merged.

  • Pipeline finished with Failed
    2 months ago
    Total: 346s
    #310274
  • Pipeline finished with Failed
    2 months ago
    Total: 330s
    #310334
  • πŸ‡¬πŸ‡§United Kingdom jonathanshaw Stroud, UK

    Unfortunately extending EntityAccessControlHandler is a breach of the interface:

      37     Parameter #1 $host_entity (Drupal\registration\HostEntityInterface)      
             of method                                                                
             Drupal\registration\RegistrationHostAccessControlHandler::access() is    
             not contravariant with parameter #1 $entity                              
             (Drupal\Core\Entity\EntityInterface) of method                           
             Drupal\Core\Entity\EntityAccessControlHandler::access().                 
      105    Parameter #1 $host_entity (Drupal\registration\HostEntityInterface)      
             of method                                                                
             Drupal\registration\RegistrationHostAccessControlHandler::checkAccess()  
             is not contravariant with parameter #1 $entity                           
             (Drupal\Core\Entity\EntityInterface) of method                           
             Drupal\Core\Entity\EntityAccessControlHandler::checkAccess(). 
  • Pipeline finished with Running
    2 months ago
    #310427
  • Pipeline finished with Failed
    2 months ago
    #310458
  • Pipeline finished with Success
    2 months ago
    #310471
  • πŸ‡¬πŸ‡§United Kingdom jonathanshaw Stroud, UK
  • Pipeline finished with Success
    2 months ago
    #310495
  • πŸ‡ΊπŸ‡ΈUnited States john.oltman

    Question about adding a test

  • Pipeline finished with Success
    2 months ago
    Total: 409s
    #310920
  • πŸ‡¬πŸ‡§United Kingdom jonathanshaw Stroud, UK

    Answered

  • πŸ‡ΊπŸ‡ΈUnited States john.oltman

    Merged, great stuff Jonathan

    Fumbled the commit message on 3.3.x but otherwise it's in and there is no going back. Got it right on 3.1.x.

    3.1.x is failing tests due to a composer issue - may be something upstream - will look into later

  • Automatically closed - issue fixed for 2 weeks with no activity.

Production build 0.71.5 2024