Entity Access By Role Field Configuration

This is an additional access control module that prevents unauthorised users from accessing restricted node content on drupal. The problem statement is this:

1. Drupal only allows a single View Node permission which is an all or none thing - thus users with defined roles have the permission to view all content (nodes) or none.
2. If we restrict the access to content to specific roles like doctors, nurses etc, other roles as as new users will not be able to see any content on the website.

Therefore we use this module to enable this access. What this allows us to do is to add a field in each content type which has details of the roles which can view that content type. Thus this is created per content type. To understand this a bit better lets look at an example.

Lets say when a patient fills in the "EORTC QLQ C30 questionnaire" the Webform Entity Handlercreates a new content type called "EORTC QLQC30" that stores the results that the answers that the patient provides when filling the questionniare. Why this is needed is explained here. This content type is created using the Webform Entity Handler automatically and therefore if we just give view content permission to all users, then all users can view the results. To prevent this from happening for each content we add a Entity Access by Role Field that will allow us to select the default entities that will be able to access the given content type (in this example the EORTC QLQC30 content type).

The settings in the field are self explanatory.

The first setting is allowed operations to access this entity. This allows us to define if the content can be viewed, edited or deleted. For our purposes we select that only View Published is selected that is the roles will not be able to edit or delete the content.

The next setting is to choose the option for access to the entity if no role is selected. We basically keep this as Access Forbidden thereby preventing people from accessing this content. This ensure that if the field is blank no one can view the published content. Note that we have the permission for the operations in the section just above this.

The final piece of the puzzle is to setup a Default Value of the field. Here there is an important gotcha. Ensure that field settings of this field allow Unlimited number of values else you will see that this allow selection of a single role only.

We enure that the default value of the field is that it allows access to the selected roles viz. Doctors, Nurses, Coordinators, Project Managers and administrators. Therefore the result can be seen by these user roles.

How this works

1. Questionnaire is submitted by patient.
2. Webform Entity Handler created a new content based on the answers.
3. The default value of this new content is the setting above thereby restricting access to anonymous accounts, authenticated user and patients.
4. Thus when ever a content of this type is created by the Entity Handler module the default field is filled and view access restrictions are in place.

Note that it is possible to reuse this setting across multiple contact types thereby easing the burden associated with the submission. It is also possible to create new field so that a more custom set of patients can get access. Note that this field should not be configured on the Webform Node content type else it will make the access control inflexible.