function ReferenceAccessConstraintValidator::validate

File

core/lib/Drupal/Core/Entity/Plugin/Validation/Constraint/ReferenceAccessConstraintValidator.php, line 16

Class

ReferenceAccessConstraintValidator

Checks if the current user has access to newly referenced entities.

Namespace

Code

public function validate($value, Constraint $constraint) {
    
    /** @var \Drupal\Core\Field\FieldItemInterface $value */
    if (!isset($value)) {
        return;
    }
    $id = $value->target_id;
    // '0' or NULL are considered valid empty references.
    if (empty($id)) {
        return;
    }
    
    /** @var \Drupal\Core\Entity\FieldableEntityInterface $referenced_entity */
    $referenced_entity = $value->entity;
    if ($referenced_entity) {
        $entity = $value->getEntity();
        $check_permission = TRUE;
        if (!$entity->isNew()) {
            $existing_entity = \Drupal::entityTypeManager()->getStorage($entity->getEntityTypeId())
                ->loadUnchanged($entity->id());
            $referenced_entities = $existing_entity->{$value->getFieldDefinition()
                ->getName()}
                ->referencedEntities();
            // Check permission if we are not already referencing the entity.
            foreach ($referenced_entities as $ref) {
                if (isset($referenced_entities[$ref->id()])) {
                    $check_permission = FALSE;
                    break;
                }
            }
        }
        // We check that the current user had access to view any newly added
        // referenced entity.
        if ($check_permission && !$referenced_entity->access('view')) {
            $type = $value->getFieldDefinition()
                ->getSetting('target_type');
            $this->context
                ->addViolation($constraint->message, [
                '%type' => $type,
                '%id' => $id,
            ]);
        }
    }
}