Chris@17: <?php
Chris@17: 
Chris@17: namespace Drupal\workspaces;
Chris@17: 
Chris@17: use Drupal\Core\Access\AccessResult;
Chris@17: use Drupal\Core\Entity\EntityAccessControlHandler;
Chris@17: use Drupal\Core\Entity\EntityInterface;
Chris@17: use Drupal\Core\Session\AccountInterface;
Chris@17: 
Chris@17: /**
Chris@17:  * Defines the access control handler for the workspace entity type.
Chris@17:  *
Chris@17:  * @see \Drupal\workspaces\Entity\Workspace
Chris@17:  */
Chris@17: class WorkspaceAccessControlHandler extends EntityAccessControlHandler {
Chris@17: 
Chris@17:   /**
Chris@17:    * {@inheritdoc}
Chris@17:    */
Chris@17:   protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account) {
Chris@17:     /** @var \Drupal\workspaces\WorkspaceInterface $entity */
Chris@17:     if ($operation === 'delete' && $entity->isDefaultWorkspace()) {
Chris@17:       return AccessResult::forbidden()->addCacheableDependency($entity);
Chris@17:     }
Chris@17: 
Chris@17:     if ($account->hasPermission('administer workspaces')) {
Chris@17:       return AccessResult::allowed()->cachePerPermissions();
Chris@17:     }
Chris@17: 
Chris@17:     // The default workspace is always viewable, no matter what.
Chris@17:     if ($operation == 'view' && $entity->isDefaultWorkspace()) {
Chris@17:       return AccessResult::allowed()->addCacheableDependency($entity);
Chris@17:     }
Chris@17: 
Chris@17:     $permission_operation = $operation === 'update' ? 'edit' : $operation;
Chris@17: 
Chris@17:     // Check if the user has permission to access all workspaces.
Chris@17:     $access_result = AccessResult::allowedIfHasPermission($account, $permission_operation . ' any workspace');
Chris@17: 
Chris@17:     // Check if it's their own workspace, and they have permission to access
Chris@17:     // their own workspace.
Chris@17:     if ($access_result->isNeutral() && $account->isAuthenticated() && $account->id() === $entity->getOwnerId()) {
Chris@17:       $access_result = AccessResult::allowedIfHasPermission($account, $permission_operation . ' own workspace')
Chris@17:         ->cachePerUser()
Chris@17:         ->addCacheableDependency($entity);
Chris@17:     }
Chris@17: 
Chris@17:     return $access_result;
Chris@17:   }
Chris@17: 
Chris@17:   /**
Chris@17:    * {@inheritdoc}
Chris@17:    */
Chris@17:   protected function checkCreateAccess(AccountInterface $account, array $context, $entity_bundle = NULL) {
Chris@17:     return AccessResult::allowedIfHasPermission($account, 'create workspace');
Chris@17:   }
Chris@17: 
Chris@17: }