Determining entity field access¶

Plugin ID: access:field

Available since: 1.0.0

Provided tokens

Token	Description
`[user]`	The current user. Alias: `current_user`
`[htmx]`	Information about the current HTMX request.
`[htmx:is_request]`	Whether the current request was sent by HTMX ("1" or "0").
`[htmx:boosted]`	Whether the current request was boosted by HTMX ("1" or "0").
`[htmx:history_restore]`	Whether the current request is for HTMX history restoration ("1" or "0").
`[htmx:target]`	The identifier of the element the response is targeted at.
`[htmx:trigger]`	The identifier of the element that triggered the request. On Drupal 11 this is the element id, on Drupal 12 and later it is the CSS selector that htmx 4 sends. Prefer "trigger_name", which means the same thing on both.
`[htmx:trigger_name]`	The name attribute of the element that triggered the request, or empty if it has none. This has the same meaning on all supported Drupal versions.
`[htmx:source]`	The CSS selector of the element that triggered the request, for example button[name="first_item"]. Empty on Drupal 11, which does not send this information.
`[htmx:request_type]`	Whether the request targets a full page or a fragment: "full" or "partial". Empty on Drupal 11, which does not send this information.
`[htmx:current_url]`	The URL of the page the request was sent from.
`[event]`	The event.
`[event:entity_bundle]`	The bundle of the entity.
`[event:entity_id]`	The entity ID, only available if the entity is not new.
`[event:entity_type]`	The entity type.
`[event:field]`	The name of the field.
`[event:operation]`	The operation with which the entity should be accessed, e.g. "view", "update", etc.
`[event:uid]`	The ID of the user account of the event.
`[event]`	The event.
`[event:machine_name]`	The machine name of the ECA event.
`[session_user]`	The user account that dispatched the event, regardless if ECA is processing models under a different account. This is only available if ECA is configured to always run under a specific account.
`[account]`	The user account of the event.
`[entity]`	The entity of the event.
`[ENTITY_TYPE]`	The entity of the event under the name of its entity type.

Fires when Drupal checks whether a user can access a specific field on an entity. This wraps Drupal's hook_entity_field_access().

Use the Set access result action to grant or deny access.

High frequency event

This event fires for every field on every entity during page rendering. Always use specific filters (entity type, bundle, field name, operation) to narrow matches and avoid performance issues.

Note: Field access operations are view and edit (not update/delete as with entity-level access).

Fields¶

For any successor of this event, the account that asks for access is available under the [account] token. Example: [account:uid] provides the user ID of the account.

Furthermore, following data of the event is available:<ul><li>[event:operation] holds the requested operation, such as "view".</li><li>[event:field] holds the machine name of the field.</li></ul>

Restrict by entity type ID — config key: entity_type_id

Example: node, taxonomy_term, user

Type: textfield · Required: no · Default: empty string

Restricts to the specified entity type (e.g., node, taxonomy_term). Comma-separated for multiple values.

Restrict by entity bundle — config key: bundle

Example: article, tags

Type: textfield · Required: no · Default: empty string

Restricts to the specified bundle (e.g., article, tags). Comma-separated for multiple values.

Restrict by operation — config key: operation

Example: view, edit

Type: textfield · Required: no · Default: empty string

Restricts to the specified operation. For field access, the operations are view and edit (not update or delete).

Restrict by field name — config key: field_name

Example: title, body, field_myfield

Type: textfield · Required: no · Default: empty string

Restricts to the specified field machine name (e.g., title, body, field_image). Comma-separated for multiple values. Highly recommended to set this to avoid triggering on every field access check.