Chris@0: <?php
Chris@0: 
Chris@0: namespace Drupal\Core\Entity;
Chris@0: 
Chris@0: use Drupal\Core\Access\AccessResult;
Chris@0: use Drupal\Core\Routing\Access\AccessInterface;
Chris@0: use Drupal\Core\Routing\RouteMatchInterface;
Chris@0: use Drupal\Core\Session\AccountInterface;
Chris@0: use Symfony\Component\Routing\Route;
Chris@0: 
Chris@0: /**
Chris@0:  * Provides a generic access checker for entities.
Chris@0:  */
Chris@0: class EntityAccessCheck implements AccessInterface {
Chris@0: 
Chris@0:   /**
Chris@0:    * Checks access to the entity operation on the given route.
Chris@0:    *
Chris@0:    * The route's '_entity_access' requirement must follow the pattern
Chris@0:    * 'entity_stub_name.operation', where available operations are:
Chris@0:    * 'view', 'update', 'create', and 'delete'.
Chris@0:    *
Chris@0:    * For example, this route configuration invokes a permissions check for
Chris@0:    * 'update' access to entities of type 'node':
Chris@0:    * @code
Chris@0:    * pattern: '/foo/{node}/bar'
Chris@0:    * requirements:
Chris@0:    *   _entity_access: 'node.update'
Chris@0:    * @endcode
Chris@0:    * And this will check 'delete' access to a dynamic entity type:
Chris@0:    * @code
Chris@0:    * example.route:
Chris@0:    *   path: foo/{entity_type}/{example}
Chris@0:    *   requirements:
Chris@0:    *     _entity_access: example.delete
Chris@0:    *   options:
Chris@0:    *     parameters:
Chris@0:    *       example:
Chris@0:    *         type: entity:{entity_type}
Chris@0:    * @endcode
Chris@0:    * The route match parameter corresponding to the stub name is checked to
Chris@0:    * see if it is entity-like i.e. implements EntityInterface.
Chris@0:    *
Chris@0:    * @see \Drupal\Core\ParamConverter\EntityConverter
Chris@0:    *
Chris@0:    * @param \Symfony\Component\Routing\Route $route
Chris@0:    *   The route to check against.
Chris@0:    * @param \Drupal\Core\Routing\RouteMatchInterface $route_match
Chris@0:    *   The parametrized route
Chris@0:    * @param \Drupal\Core\Session\AccountInterface $account
Chris@0:    *   The currently logged in account.
Chris@0:    *
Chris@0:    * @return \Drupal\Core\Access\AccessResultInterface
Chris@0:    *   The access result.
Chris@0:    */
Chris@0:   public function access(Route $route, RouteMatchInterface $route_match, AccountInterface $account) {
Chris@0:     // Split the entity type and the operation.
Chris@0:     $requirement = $route->getRequirement('_entity_access');
Chris@0:     list($entity_type, $operation) = explode('.', $requirement);
Chris@0:     // If $entity_type parameter is a valid entity, call its own access check.
Chris@0:     $parameters = $route_match->getParameters();
Chris@0:     if ($parameters->has($entity_type)) {
Chris@0:       $entity = $parameters->get($entity_type);
Chris@0:       if ($entity instanceof EntityInterface) {
Chris@0:         return $entity->access($operation, $account, TRUE);
Chris@0:       }
Chris@0:     }
Chris@0:     // No opinion, so other access checks should decide if access should be
Chris@0:     // allowed or not.
Chris@0:     return AccessResult::neutral();
Chris@0:   }
Chris@0: 
Chris@0: }