Entity Access by Reference Field

Feature Overview

Allows to control access to entities based on entity reference fields.
With this module, you can define access conditions on entity reference fields for the host entity.

Configurable examples:

• If a user is allowed to view the referenced entity, he is also allowed to view the host entity.
• If a user is allowed to edit the referenced entity, he is also allowed to edit the host entity.
• If a user is allowed to delete the referenced entity, he is also allowed to delete the host entity.
• If a user is allowed to edit the referenced entity, he is also allowed to edit or delete the host entity.
• If a user is the referenced entity, he is allowed to edit the host entity.

The fallback behavior (allow, neutral, deny) and the empty behaviour (if a host entity does not have a referenced entity set) is also defined per field.

Note, that this module uses third party settings on the field storage, meaning multiple field instances of the same field will share the settings!

Currently supported access checks:

• View
• View Unpublished
• Edit
• Delete
• Is User (referenced user entity only)

Views support

This module implements hook_entity_access() to dynamically calculate entity access permissions. Due to the complex logic it doesn't implement hook_query_TAG_alter().
So Views may display entities, which are "Access denied" for the users! Take care, in some combination this may lead to information disclosure for such Views contents (e.g. seeing the label you should not see).

Until the core issue (#777578: Add an entity query access API and deprecate hook_query_ENTITY_TYPE_access_alter()) is fixed, you may try the views_entity_access_check module if you're running into such cases:
https://www.drupal.org/project/views_entity_access_check
And please help to push a core solution in the linked issue.

Future plans (if community helps):

If the community helps to develop the functionality or development is sponsored, there are further ideas that might be added here, like

• Condition: Current user created the referenced entity

... any other ideas? Please create an issue and help to develop the functionality.

History & reasons for this module

This module was born, as we already had experience and a good starting point with our Entity Access by Role Field module.
In Drupal 7 we loved to use Node access node reference and Node access user reference which have no Drupal 8+ release.
We tried Access by Reference module, but it didn't work really well. https://www.drupal.org/project/reference_access does similar things, just the other way around (referencing from the user page).

As we didn't find a good (enough) alternative, we decided to create this module based on our existing Entity Access by Role Field code and knowledge.

Debugging permissions / entity access

For debugging permissions on entities, the following modules can be helpful:

1. Devel
2. Web Profiler
3. Drush Tools
4. Masquerade

Similar modules & alternatives

You may want to have a look at these alternatives, before making the choice:

• https://www.drupal.org/project/access_policy seems very powerful but also complex
• Access by Reference (similar but different UX)
• Reference Access (vice versa)
• Group (Very complex and flexible)

For Drupal 7 there were some more helpful modules like:

• Nodeaccess
• Node access node reference
• Node access user reference
• Node Access Relation
• Nodeaccess Autoreference

For other use-cases:

• Entity Access by Role Field
• Content Access
• Node View Permissions
• Field Permissions
• View unpublished
• Flexible Permissions
• Access Policy

Need to select roles instead (per entitiy)

If you need to grant access (CRUD) to single entities by selecting roles instead in a flexible way, instead have a look at Entity Access by Role Field Module instead, which provides such functionality on role reference fields.

Supporting this module

Support DROWL's ♥ FOSS work on this module on OpenCollective!

Drupal and this module are FOSS. However, it takes dedicated people to develop and maintain. And they need YOU to give back!

We're committed to building and maintaining Drupal modules that benefit the entire community.

Supporting us on OpenCollective helps us continue to improve, innovate and contribute to Drupal's future. Every pledge makes a difference!

If this module has helped you, we would be very grateful for your donation to support its further development and maintenance.

Support our FOSS development ♥️

You can also speed up the development of features or bugfixes you'd love to see, by sponsoring and giving back!

Sponsor a feature or bugfix 🚀

Let's make Drupal even better, together!

Development proudly sponsored by German Drupal Friends & Companies:

webks: websolutions kept simple (https://www.webks.de)
and
DROWL: Drupalbasierte Lösungen aus Ostwestfalen-Lippe (OWL), Germany (https://www.drowl.de)