drupal-eca-recipe / eca_lib_0003

3.1.9 2026-08-30 16:41 UTC

Requires

• drupal/eca: *
• drupal/modeler_api: *

GPL-2.0-or-later

Published on Packagist.org on 2026-08-30 16:41 UTC

README

ID: eca_lib_0003

When a visitor requests an unpublished article node and does not hold the view own unpublished content permission, this model redirects them to the contact form instead of leaving them at Drupal's access-denied page.

The order of the steps carries the lesson. The permission check sits directly on the request event, so it reads the real visitor. Only afterwards does the model switch to user 1, and that switch is what allows it to load the node from the route and read its status at all. Checking the permission after the switch would test user 1, who holds everything, and nobody would ever be redirected.

What this permission covers, and what it does not

view own unpublished content is the only unpublished-node permission Drupal core ships, and its name is precise: it governs a user's access to their own unpublished content. The check is therefore narrower than "may see unpublished nodes".

• A visitor who lacks the permission gets redirected. That is the case this model demonstrates.
• A visitor who holds the permission but did not author the node does not get redirected. Drupal's node access check then denies the request, so they land on a 403 rather than the contact form.

The second case is a property of the model, not an oversight to work around silently. The permission condition runs before the node has been loaded, so at that moment there is nothing to compare an author against; ownership simply cannot be judged there.

A site that needs the wider behavior has to bring its own permission — view any unpublished content comes from Content Moderation, not from core — or extend this model with a comparison of [mynode:uid] against the current user, placed after the node is loaded rather than on the event.

Installation

## Import recipe
composer require drupal-eca-recipe/eca_lib_0003

# Apply recipe with Drush (requires version 13 or later):
drush recipe ../recipes/eca_lib_0003

# Apply recipe without Drush:
cd web && php core/scripts/drupal recipe ../recipes/eca_lib_0003

# Rebuilding caches is optional, sometimes required:
drush cr