diff --git a/og.api.php b/og.api.php
new file mode 100644
index 000000000..203da84a0
--- /dev/null
+++ b/og.api.php
@@ -0,0 +1,59 @@
+<?php
+
+/**
+ * @file
+ * Hooks provided by the Organic Groups module.
+ */
+
+declare(strict_types = 1);
+
+use Drupal\Core\Cache\CacheableMetadata;
+use Drupal\Core\Entity\EntityPublishedInterface;
+use Drupal\og\OgAccess;
+
+/**
+ * @addtogroup hooks
+ * @{
+ */
+
+/**
+ * Allows modules to alter group level permissions.
+ *
+ * @param array $permissions
+ *   The list of group level permissions, passed by reference.
+ * @param \Drupal\Core\Cache\CacheableMetadata $cacheable_metadata
+ *   The cache metadata.
+ * @param array $context
+ *   An associative array containing contextual information, with keys:
+ *   - 'permission': The group level permission being checked, as a string.
+ *   - 'group': The group entity on which the permission applies.
+ *   - 'user': The user account for which access is being determined.
+ */
+function hook_og_user_access_alter(array &$permissions, CacheableMetadata $cacheable_metadata, array $context): void {
+  // This example implements a use case where a custom module allows site
+  // builders to toggle a configuration setting that will prevent groups to be
+  // deleted if they are published.
+  // Retrieve the module configuration.
+  $config = \Drupal::config('mymodule.settings');
+
+  // Check if the site is configured to allow deletion of published groups.
+  $published_groups_can_be_deleted = $config->get('delete_published_groups');
+
+  // If deletion is not allowed and the group is published, revoke the
+  // permission.
+  $group = $context['group'];
+  if ($group instanceof EntityPublishedInterface && !$group->isPublished() && !$published_groups_can_be_deleted) {
+    $key = array_search(OgAccess::DELETE_GROUP_PERMISSION, $permissions);
+    if ($key !== FALSE) {
+      unset($permissions[$key]);
+    }
+  }
+
+  // Since our access result depends on our custom module configuration, we need
+  // to add it to the cache metadata.
+  $cacheable_metadata->addCacheableDependency($config);
+}
+
+/**
+ * @} End of "addtogroup hooks".
+ */
diff --git a/og.services.yml b/og.services.yml
index be1821d89..f78b568d4 100644
--- a/og.services.yml
+++ b/og.services.yml
@@ -21,7 +21,7 @@ services:
       - { name: 'cache.context'}
   og.access:
     class: Drupal\og\OgAccess
-    arguments: ['@config.factory', '@current_user', '@module_handler', '@og.group_type_manager', '@og.permission_manager', '@og.membership_manager']
+    arguments: ['@config.factory', '@current_user', '@module_handler', '@og.group_type_manager', '@og.permission_manager', '@og.membership_manager', '@event_dispatcher']
   og.context:
     class: Drupal\og\ContextProvider\OgContext
     arguments: ['@plugin.manager.og.group_resolver', '@config.factory']
@@ -29,7 +29,7 @@ services:
       - { name: 'context_provider' }
   og.event_subscriber:
     class: Drupal\og\EventSubscriber\OgEventSubscriber
-    arguments: ['@og.permission_manager', '@entity_type.manager', '@entity_type.bundle.info']
+    arguments: ['@og.permission_manager', '@entity_type.manager', '@entity_type.bundle.info', '@og.access']
     tags:
       - { name: 'event_subscriber' }
   og.group_audience_helper:
diff --git a/src/Event/AccessEventBase.php b/src/Event/AccessEventBase.php
new file mode 100644
index 000000000..740864ce8
--- /dev/null
+++ b/src/Event/AccessEventBase.php
@@ -0,0 +1,98 @@
+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\og\Event;
+
+use Drupal\Core\Access\AccessResult;
+use Drupal\Core\Access\AccessResultInterface;
+use Drupal\Core\Cache\RefinableCacheableDependencyInterface;
+use Drupal\Core\Cache\RefinableCacheableDependencyTrait;
+use Drupal\Core\Entity\ContentEntityInterface;
+use Drupal\Core\Session\AccountInterface;
+use Symfony\Component\EventDispatcher\Event;
+
+/**
+ * Base class for OG access events.
+ */
+class AccessEventBase extends Event implements AccessEventInterface {
+
+  use RefinableCacheableDependencyTrait;
+
+  /**
+   * The access result.
+   *
+   * @var \Drupal\Core\Access\AccessResultInterface
+   */
+  protected $access;
+
+  /**
+   * The group that provides the context for the access check.
+   *
+   * @var \Drupal\Core\Entity\ContentEntityInterface
+   */
+  protected $group;
+
+  /**
+   * The user for which to check access.
+   *
+   * @var \Drupal\Core\Session\AccountInterface
+   */
+  protected $user;
+
+  /**
+   * Constructs an AccessEventBase event.
+   *
+   * @param \Drupal\Core\Entity\ContentEntityInterface $group
+   *   The group that provides the context in which to perform the access check.
+   * @param \Drupal\Core\Session\AccountInterface $user
+   *   The user for which to check access.
+   */
+  public function __construct(ContentEntityInterface $group, AccountInterface $user) {
+    $this->group = $group;
+    $this->user = $user;
+    $this->access = AccessResult::neutral();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function grantAccess(): void {
+    $this->access = $this->access->orIf(AccessResult::allowed());
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function denyAccess(): void {
+    $this->access = $this->access->orIf(AccessResult::forbidden());
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getGroup(): ContentEntityInterface {
+    return $this->group;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getUser(): AccountInterface {
+    return $this->user;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getAccessResult(): AccessResultInterface {
+    $access = $this->access;
+
+    if ($access instanceof RefinableCacheableDependencyInterface) {
+      $access->addCacheableDependency($this);
+    }
+
+    return $access;
+  }
+
+}
diff --git a/src/Event/AccessEventInterface.php b/src/Event/AccessEventInterface.php
new file mode 100644
index 000000000..01f23bf08
--- /dev/null
+++ b/src/Event/AccessEventInterface.php
@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\og\Event;
+
+use Drupal\Core\Access\AccessResultInterface;
+use Drupal\Core\Cache\RefinableCacheableDependencyInterface;
+use Drupal\Core\Entity\ContentEntityInterface;
+use Drupal\Core\Session\AccountInterface;
+
+/**
+ * Interface for events that determine access in Organic Groups.
+ */
+interface AccessEventInterface extends RefinableCacheableDependencyInterface {
+
+  /**
+   * Declare that access is being granted.
+   *
+   * Calling this method will cause access to be granted for the action that is
+   * being checked, unless another event listener denies access.
+   */
+  public function grantAccess(): void;
+
+  /**
+   * Declare that access is being denied.
+   *
+   * Calling this method will cause access to be denied for the action that is
+   * being checked. This takes precedence over any other event listeners that
+   * might grant access.
+   */
+  public function denyAccess(): void;
+
+  /**
+   * Returns the group that provides the context for the access check.
+   *
+   * @return \Drupal\Core\Entity\ContentEntityInterface
+   *   The group entity.
+   */
+  public function getGroup(): ContentEntityInterface;
+
+  /**
+   * Returns the user for which access is being determined.
+   *
+   * @return \Drupal\Core\Session\AccountInterface
+   *   The user.
+   */
+  public function getUser(): AccountInterface;
+
+  /**
+   * Returns the current access result object.
+   *
+   * @return \Drupal\Core\Access\AccessResultInterface
+   *   The access result object.
+   */
+  public function getAccessResult(): AccessResultInterface;
+
+}
diff --git a/src/Event/GroupContentEntityOperationAccessEvent.php b/src/Event/GroupContentEntityOperationAccessEvent.php
new file mode 100644
index 000000000..833608335
--- /dev/null
+++ b/src/Event/GroupContentEntityOperationAccessEvent.php
@@ -0,0 +1,61 @@
+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\og\Event;
+
+use Drupal\Core\Entity\ContentEntityInterface;
+use Drupal\Core\Session\AccountInterface;
+
+/**
+ * Event that determines access to group content entity operations.
+ */
+class GroupContentEntityOperationAccessEvent extends AccessEventBase implements GroupContentEntityOperationAccessEventInterface {
+
+  /**
+   * The entity operation being performed.
+   *
+   * @var string
+   */
+  protected $operation;
+
+  /**
+   * The group content entity upon which the operation is being performed.
+   *
+   * @var \Drupal\Core\Entity\ContentEntityInterface
+   */
+  protected $groupContent;
+
+  /**
+   * Constructs a GroupContentEntityOperationAccessEvent.
+   *
+   * @param string $operation
+   *   The entity operation, such as "create", "update" or "delete".
+   * @param \Drupal\Core\Entity\ContentEntityInterface $group
+   *   The group in scope of which the access check is being performed.
+   * @param \Drupal\Core\Entity\ContentEntityInterface $groupContent
+   *   The group content upon which the entity operation is performed.
+   * @param \Drupal\Core\Session\AccountInterface $user
+   *   The user for which to check access.
+   */
+  public function __construct(string $operation, ContentEntityInterface $group, ContentEntityInterface $groupContent, AccountInterface $user) {
+    parent::__construct($group, $user);
+    $this->operation = $operation;
+    $this->groupContent = $groupContent;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getOperation(): string {
+    return $this->operation;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getGroupContent(): ContentEntityInterface {
+    return $this->groupContent;
+  }
+
+}
diff --git a/src/Event/GroupContentEntityOperationAccessEventInterface.php b/src/Event/GroupContentEntityOperationAccessEventInterface.php
new file mode 100644
index 000000000..649992852
--- /dev/null
+++ b/src/Event/GroupContentEntityOperationAccessEventInterface.php
@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\og\Event;
+
+use Drupal\Core\Entity\ContentEntityInterface;
+
+/**
+ * Interface for events that provide access to group content entity operations.
+ */
+interface GroupContentEntityOperationAccessEventInterface extends AccessEventInterface {
+
+  /**
+   * The event name.
+   */
+  const EVENT_NAME = 'og.group_content_entity_operation_access';
+
+  /**
+   * Returns the entity operation being performed.
+   *
+   * @return string
+   *   The entity operation, such as 'create', 'update' or 'delete'.
+   */
+  public function getOperation(): string;
+
+  /**
+   * Returns the group content entity upon which the operation is performed.
+   *
+   * @return \Drupal\Core\Entity\ContentEntityInterface
+   *   The group content entity.
+   */
+  public function getGroupContent(): ContentEntityInterface;
+
+}
diff --git a/src/EventSubscriber/OgEventSubscriber.php b/src/EventSubscriber/OgEventSubscriber.php
index ebf55e104..8d363fab8 100644
--- a/src/EventSubscriber/OgEventSubscriber.php
+++ b/src/EventSubscriber/OgEventSubscriber.php
@@ -8,13 +8,16 @@
 use Drupal\Core\Entity\EntityTypeManagerInterface;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Drupal\og\Event\DefaultRoleEventInterface;
+use Drupal\og\Event\GroupContentEntityOperationAccessEventInterface;
 use Drupal\og\Event\OgAdminRoutesEventInterface;
 use Drupal\og\Event\PermissionEventInterface;
 use Drupal\og\GroupContentOperationPermission;
 use Drupal\og\GroupPermission;
 use Drupal\og\OgAccess;
+use Drupal\og\OgAccessInterface;
 use Drupal\og\OgRoleInterface;
 use Drupal\og\PermissionManagerInterface;
+use Drupal\user\EntityOwnerInterface;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
 /**
@@ -45,6 +48,13 @@ class OgEventSubscriber implements EventSubscriberInterface {
    */
   protected $entityTypeBundleInfo;
 
+  /**
+   * The OG access service.
+   *
+   * @var \Drupal\og\OgAccessInterface
+   */
+  protected $ogAccess;
+
   /**
    * Constructs an OgEventSubscriber object.
    *
@@ -54,11 +64,14 @@ class OgEventSubscriber implements EventSubscriberInterface {
    *   The entity type manager.
    * @param \Drupal\Core\Entity\EntityTypeBundleInfoInterface $entity_type_bundle_info
    *   The service providing information about bundles.
+   * @param \Drupal\og\OgAccessInterface $og_access
+   *   The OG access service.
    */
-  public function __construct(PermissionManagerInterface $permission_manager, EntityTypeManagerInterface $entity_type_manager, EntityTypeBundleInfoInterface $entity_type_bundle_info) {
+  public function __construct(PermissionManagerInterface $permission_manager, EntityTypeManagerInterface $entity_type_manager, EntityTypeBundleInfoInterface $entity_type_bundle_info, OgAccessInterface $og_access) {
     $this->permissionManager = $permission_manager;
     $this->entityTypeManager = $entity_type_manager;
     $this->entityTypeBundleInfo = $entity_type_bundle_info;
+    $this->ogAccess = $og_access;
   }
 
   /**
@@ -76,6 +89,7 @@ public static function getSubscribedEvents() {
       ],
       DefaultRoleEventInterface::EVENT_NAME => [['provideDefaultRoles']],
       OgAdminRoutesEventInterface::EVENT_NAME => [['provideOgAdminRoutes']],
+      GroupContentEntityOperationAccessEventInterface::EVENT_NAME => [['checkGroupContentEntityOperationAccess']],
     ];
   }
 
@@ -367,4 +381,53 @@ public function provideOgAdminRoutes(OgAdminRoutesEventInterface $event) {
     $event->setRoutesInfo($routes_info);
   }
 
+  /**
+   * Checks if a user has access to perform a group content entity operation.
+   *
+   * @param \Drupal\og\Event\GroupContentEntityOperationAccessEventInterface $event
+   *   The event fired when a group content entity operation is performed.
+   */
+  public function checkGroupContentEntityOperationAccess(GroupContentEntityOperationAccessEventInterface $event): void {
+    $group_content_entity = $event->getGroupContent();
+    $group_entity = $event->getGroup();
+    $user = $event->getUser();
+    $operation = $event->getOperation();
+
+    // Check if the user owns the entity which is being operated on.
+    $is_owner = $group_content_entity instanceof EntityOwnerInterface && $group_content_entity->getOwnerId() == $user->id();
+
+    // Retrieve the group content entity operation permissions.
+    $group_entity_type_id = $group_entity->getEntityTypeId();
+    $group_bundle_id = $group_entity->bundle();
+    $group_content_bundle_ids = [$group_content_entity->getEntityTypeId() => [$group_content_entity->bundle()]];
+
+    $permissions = $this->permissionManager->getDefaultEntityOperationPermissions($group_entity_type_id, $group_bundle_id, $group_content_bundle_ids);
+
+    // Filter the permissions by operation and ownership.
+    // If the user does not own the group content, only the non-owner permission
+    // is relevant (for example 'edit any article node'). However when the user
+    // _is_ the owner, then both permissions are relevant: an owner will have
+    // access if they either have the 'edit any article node' or the 'edit own
+    // article node' permission.
+    $ownerships = $is_owner ? [FALSE, TRUE] : [FALSE];
+    $permissions = array_filter($permissions, function (GroupContentOperationPermission $permission) use ($operation, $ownerships) {
+      return $permission->getOperation() === $operation && in_array($permission->getOwner(), $ownerships);
+    });
+
+    if ($permissions) {
+      foreach ($permissions as $permission) {
+        // This currently does not handle access in the same way as Drupal core
+        // does - if any of the permissions grant access we will grant access.
+        // Once OgAccess::userAccess() is refactored to return a neutral result
+        // in case no access is determined we can just apply the result
+        // directly.
+        $access_result = $this->ogAccess->userAccess($group_entity, $permission->getName(), $user);
+        if ($access_result->isAllowed()) {
+          $event->grantAccess();
+          break;
+        }
+      }
+    }
+  }
+
 }
diff --git a/src/OgAccess.php b/src/OgAccess.php
index 7a0b15356..9471adaba 100644
--- a/src/OgAccess.php
+++ b/src/OgAccess.php
@@ -13,8 +13,10 @@
 use Drupal\Core\Session\AccountInterface;
 use Drupal\Core\Session\AccountProxyInterface;
 use Drupal\og\Entity\OgRole;
+use Drupal\og\Event\GroupContentEntityOperationAccessEvent;
 use Drupal\user\EntityOwnerInterface;
 use Drupal\user\UserInterface;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
 
 /**
  * The service that determines if users have access to groups and group content.
@@ -89,6 +91,13 @@ class OgAccess implements OgAccessInterface {
    */
   protected $membershipManager;
 
+  /**
+   * The event dispatcher.
+   *
+   * @var \Symfony\Component\EventDispatcher\EventDispatcherInterface
+   */
+  protected $dispatcher;
+
   /**
    * Constructs the OgAccess service.
    *
@@ -104,14 +113,17 @@ class OgAccess implements OgAccessInterface {
    *   The permission manager.
    * @param \Drupal\og\MembershipManagerInterface $membership_manager
    *   The group membership manager.
+   * @param \Symfony\Component\EventDispatcher\EventDispatcherInterface $dispatcher
+   *   The event dispatcher.
    */
-  public function __construct(ConfigFactoryInterface $config_factory, AccountProxyInterface $account_proxy, ModuleHandlerInterface $module_handler, GroupTypeManagerInterface $group_manager, PermissionManagerInterface $permission_manager, MembershipManagerInterface $membership_manager) {
+  public function __construct(ConfigFactoryInterface $config_factory, AccountProxyInterface $account_proxy, ModuleHandlerInterface $module_handler, GroupTypeManagerInterface $group_manager, PermissionManagerInterface $permission_manager, MembershipManagerInterface $membership_manager, EventDispatcherInterface $dispatcher) {
     $this->configFactory = $config_factory;
     $this->accountProxy = $account_proxy;
     $this->moduleHandler = $module_handler;
     $this->groupTypeManager = $group_manager;
     $this->permissionManager = $permission_manager;
     $this->membershipManager = $membership_manager;
+    $this->dispatcher = $dispatcher;
   }
 
   /**
@@ -327,46 +339,19 @@ public function userAccessGroupContentEntityOperation(string $operation, EntityI
     // Default to the current user.
     $user = $user ?: $this->accountProxy->getAccount();
 
-    // Check if the user owns the entity which is being operated on.
-    $is_owner = $group_content_entity instanceof EntityOwnerInterface && $group_content_entity->getOwnerId() == $user->id();
-
-    // Retrieve the group content entity operation permissions.
-    $group_entity_type_id = $group_entity->getEntityTypeId();
-    $group_bundle_id = $group_entity->bundle();
-    $group_content_bundle_ids = [$group_content_entity->getEntityTypeId() => [$group_content_entity->bundle()]];
-
-    $permissions = $this->permissionManager->getDefaultEntityOperationPermissions($group_entity_type_id, $group_bundle_id, $group_content_bundle_ids);
-
-    // Filter the permissions by operation and ownership.
-    // If the user does not own the group content, only the non-owner permission
-    // is relevant (for example 'edit any article node'). However when the user
-    // _is_ the owner, then both permissions are relevant: an owner will have
-    // access if they either have the 'edit any article node' or the 'edit own
-    // article node' permission.
-    $ownerships = $is_owner ? [FALSE, TRUE] : [FALSE];
-    $permissions = array_filter($permissions, function (GroupContentOperationPermission $permission) use ($operation, $ownerships) {
-      return $permission->getOperation() === $operation && in_array($permission->getOwner(), $ownerships);
-    });
-
-    if ($permissions) {
-      foreach ($permissions as $permission) {
-        $user_access = $this->userAccess($group_entity, $permission->getName(), $user);
-        if ($user_access->isAllowed()) {
-          return $user_access;
-        }
-      }
-    }
+    $event = new GroupContentEntityOperationAccessEvent($operation, $group_entity, $group_content_entity, $user);
 
     // @todo This doesn't really vary by user but by the user's roles inside of
     //   the group. We should create a cache context for OgRole entities.
     // @see https://github.com/amitaibu/og/issues/219
-    $cacheable_metadata = new CacheableMetadata();
-    $cacheable_metadata->addCacheableDependency($group_content_entity);
+    $event->addCacheableDependency($group_content_entity);
     if ($user->id() == $this->accountProxy->id()) {
-      $cacheable_metadata->addCacheContexts(['user']);
+      $event->addCacheContexts(['user']);
     }
 
-    return AccessResult::neutral()->addCacheableDependency($cacheable_metadata);
+    $this->dispatcher->dispatch(GroupContentEntityOperationAccessEvent::EVENT_NAME, $event);
+
+    return $event->getAccessResult();
   }
 
   /**
diff --git a/tests/modules/og_test/og_test.install b/tests/modules/og_test/og_test.install
new file mode 100644
index 000000000..9b3766ef6
--- /dev/null
+++ b/tests/modules/og_test/og_test.install
@@ -0,0 +1,15 @@
+<?php
+
+/**
+ * @file
+ * Install, update and uninstall functions for the og_test module.
+ */
+
+declare(strict_types = 1);
+
+/**
+ * Implements hook_uninstall().
+ */
+function og_test_uninstall(): void {
+  \Drupal::state()->delete('og_test_group_content_entity_operation_access_alter');
+}
diff --git a/tests/modules/og_test/og_test.module b/tests/modules/og_test/og_test.module
index de4a8e560..8a886f59b 100644
--- a/tests/modules/og_test/og_test.module
+++ b/tests/modules/og_test/og_test.module
@@ -7,6 +7,9 @@
 
 declare(strict_types = 1);
 
+use Drupal\Core\Access\AccessResultAllowed;
+use Drupal\Core\Access\AccessResultInterface;
+use Drupal\Core\Cache\CacheableMetadata;
 use Drupal\Core\Entity\EntityInterface;
 use Drupal\og\Entity\OgRole;
 use Drupal\og\Og;
@@ -41,3 +44,23 @@ function og_test_entity_insert(EntityInterface $entity) {
     $membership->save();
   }
 }
+
+/**
+ * Implements hook_og_user_access_entity_operation_alter().
+ */
+function og_test_og_user_access_entity_operation_alter(AccessResultInterface &$access_result, CacheableMetadata $cacheable_metadata, $context): void {
+  if (\Drupal::state()->get('og_test_group_content_entity_operation_access_alter', FALSE)) {
+    // Moderators should have access to edit and delete all comments in all
+    // groups.
+    /** @var \Drupal\Core\Session\AccountProxyInterface $user */
+    $user = $context['user'];
+    $group_content = $context['group_content'];
+
+    $is_comment = $group_content->getEntityTypeId() === 'comment';
+    $user_can_moderate_comments = $user->hasPermission('edit and delete comments in all groups');
+
+    if ($is_comment && $user_can_moderate_comments) {
+      $access_result = new AccessResultAllowed();
+    }
+  }
+}
diff --git a/tests/modules/og_test/og_test.permissions.yml b/tests/modules/og_test/og_test.permissions.yml
new file mode 100644
index 000000000..cbf42a419
--- /dev/null
+++ b/tests/modules/og_test/og_test.permissions.yml
@@ -0,0 +1,3 @@
+# A permission given to users who can moderate comments in all groups.
+edit and delete comments in all groups:
+  title: 'Moderate comments in all groups'
diff --git a/tests/modules/og_test/og_test.services.yml b/tests/modules/og_test/og_test.services.yml
new file mode 100644
index 000000000..31fe3b475
--- /dev/null
+++ b/tests/modules/og_test/og_test.services.yml
@@ -0,0 +1,6 @@
+services:
+  og_test.event_subscriber:
+    class: Drupal\og_test\EventSubscriber\OgTestEventSubscriber
+    arguments: ['@state']
+    tags:
+      - { name: 'event_subscriber' }
diff --git a/tests/modules/og_test/src/EventSubscriber/OgTestEventSubscriber.php b/tests/modules/og_test/src/EventSubscriber/OgTestEventSubscriber.php
new file mode 100644
index 000000000..aa6300eb8
--- /dev/null
+++ b/tests/modules/og_test/src/EventSubscriber/OgTestEventSubscriber.php
@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\og_test\EventSubscriber;
+
+use Drupal\Core\State\StateInterface;
+use Drupal\og\Event\GroupContentEntityOperationAccessEventInterface;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Event subscribers for testing Organic Groups.
+ */
+class OgTestEventSubscriber implements EventSubscriberInterface {
+
+  /**
+   * The state service.
+   *
+   * @var \Drupal\Core\State\StateInterface
+   */
+  protected $state;
+
+  /**
+   * Constructs an OgTestEventSubscriber.
+   *
+   * @param \Drupal\Core\State\StateInterface $state
+   *   The state service.
+   */
+  public function __construct(StateInterface $state) {
+    $this->state = $state;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents() {
+    return [
+      GroupContentEntityOperationAccessEventInterface::EVENT_NAME => [['moderatorsCanManageComments']],
+    ];
+  }
+
+  /**
+   * Allows moderators to edit and delete comments in all groups.
+   *
+   * @param \Drupal\og\Event\GroupContentEntityOperationAccessEventInterface $event
+   *   The event that fires when an entity operation is being performed on group
+   *   content.
+   */
+  public function moderatorsCanManageComments(GroupContentEntityOperationAccessEventInterface $event): void {
+    if ($this->state->get('og_test_group_content_entity_operation_access_alter', FALSE)) {
+      // Moderators should have access to edit and delete all comments in all
+      // groups.
+      $is_comment = $event->getGroupContent()->getEntityTypeId() === 'comment';
+      $user_can_moderate_comments = $event->getUser()->hasPermission('edit and delete comments in all groups');
+
+      if ($is_comment && $user_can_moderate_comments) {
+        $event->grantAccess();
+      }
+    }
+  }
+
+}
diff --git a/tests/src/Kernel/Access/GroupContentOperationAccessAlterTest.php b/tests/src/Kernel/Access/GroupContentOperationAccessAlterTest.php
new file mode 100644
index 000000000..3a6bd10e1
--- /dev/null
+++ b/tests/src/Kernel/Access/GroupContentOperationAccessAlterTest.php
@@ -0,0 +1,179 @@
+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\Tests\og\Kernel\Access;
+
+use Drupal\KernelTests\KernelTestBase;
+use Drupal\Tests\user\Traits\UserCreationTrait;
+use Drupal\comment\Entity\Comment;
+use Drupal\comment\Entity\CommentType;
+use Drupal\entity_test\Entity\EntityTest;
+use Drupal\og\Og;
+use Drupal\og\OgGroupAudienceHelperInterface;
+use Drupal\user\Entity\User;
+
+/**
+ * Test that access to group content operations can be altered.
+ *
+ * @coversDefaultClass \Drupal\og\OgAccess
+ * @group og
+ */
+class GroupContentOperationAccessAlterTest extends KernelTestBase {
+
+  use UserCreationTrait;
+
+  /**
+   * {@inheritdoc}
+   */
+  public static $modules = [
+    'comment',
+    'entity_test',
+    'field',
+    'og',
+    'og_test',
+    'system',
+    'user',
+  ];
+
+  /**
+   * The OG access service. This is the system under test.
+   *
+   * @var \Drupal\og\OgAccessInterface
+   */
+  protected $ogAccess;
+
+  /**
+   * A test user.
+   *
+   * @var \Drupal\user\UserInterface
+   */
+  protected $user;
+
+  /**
+   * A test group.
+   *
+   * @var \Drupal\entity_test\Entity\EntityTest
+   */
+  protected $group;
+
+  /**
+   * A test group content entity.
+   *
+   * @var \Drupal\comment\CommentInterface
+   */
+  protected $groupContent;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+
+    $this->installEntitySchema('comment');
+    $this->installEntitySchema('entity_test');
+    $this->installEntitySchema('og_membership');
+    $this->installEntitySchema('user');
+    $this->installSchema('system', 'sequences');
+
+    $this->ogAccess = $this->container->get('og.access');
+
+    // Create a dummy user which will get UID 1. We cannot use this for testing
+    // since this user becomes the super administrator and is not suitable for
+    // testing access control.
+    User::create(['name' => $this->randomString()])->save();
+
+    // Create a test user with the 'moderator' role which has global permission
+    // to moderate comments in all groups, even ones they are not a member of.
+    $this->user = $this->createUser(['edit and delete comments in all groups']);
+
+    // Create the test group along with a user that serves as the group owner.
+    $group_bundle = mb_strtolower($this->randomMachineName());
+    $this->group = EntityTest::create([
+      'type' => $group_bundle,
+      'name' => $this->randomString(),
+      'user_id' => $this->createUser()->id(),
+    ]);
+    $this->group->save();
+
+    // Declare that the test entity type is a group type.
+    Og::groupTypeManager()->addGroup('entity_test', $group_bundle);
+
+    // Create a group content type.
+    CommentType::create([
+      'id' => 'comment',
+      'label' => 'Comment subscription',
+      'target_entity_type_id' => 'entity_test',
+    ])->save();
+    $settings = [
+      'field_storage_config' => [
+        'settings' => [
+          'target_type' => 'entity_test',
+        ],
+      ],
+    ];
+    Og::createField(OgGroupAudienceHelperInterface::DEFAULT_FIELD, 'comment', 'comment', $settings);
+
+    // Create a group content entity.
+    $values = [
+      'subject' => 'subscribe',
+      'comment_type' => 'comment',
+      'entity_id' => $this->group->id(),
+      'entity_type' => 'entity_test',
+      'field_name' => 'an_imaginary_field',
+      OgGroupAudienceHelperInterface::DEFAULT_FIELD => [['target_id' => $this->group->id()]],
+    ];
+    $this->groupContent = Comment::create($values);
+    $this->groupContent->save();
+  }
+
+  /**
+   * Tests that modules can alter group content entity operation access.
+   *
+   * This mimicks a use case where a moderator has access to edit and delete
+   * comments in all groups.
+   *
+   * @see \og_test_og_user_access_entity_operation_alter()
+   *
+   * @dataProvider groupContentEntityOperationAccessAlterHookTestProvider
+   */
+  public function testGroupContentEntityOperationAccessAlterHook(string $operation): void {
+    // Check that our test user doesn't have access to edit or delete comments
+    // in the group.
+    // This is the default behavior for users that are not a group member.
+    $this->assertFalse($this->userHasAccess($operation));
+
+    // Now enable our hook which will alter the group content entity operation
+    // access rules to allow moderators to edit and delete comments in all
+    // groups. Since our user is a moderator they should now have access.
+    \Drupal::state()->set('og_test_group_content_entity_operation_access_alter', TRUE);
+    $this->assertTrue($this->userHasAccess($operation));
+  }
+
+  /**
+   * Checks whether the test user has access to perform the entity operation.
+   *
+   * @param string $operation
+   *   The entity operation to check.
+   *
+   * @return bool
+   *   TRUE if the user has access, FALSE otherwise.
+   */
+  protected function userHasAccess(string $operation): bool {
+    return $this->ogAccess->userAccessGroupContentEntityOperation($operation, $this->group, $this->groupContent, $this->user)->isAllowed();
+  }
+
+  /**
+   * Provides test data for ::testGroupContentEntityOperationAccessAlterHook().
+   *
+   * @return string[][]
+   *   Test cases for the 'update' and 'delete' entity operations.
+   */
+  public function groupContentEntityOperationAccessAlterHookTestProvider(): array {
+    return [
+      ['update'],
+      ['delete'],
+    ];
+  }
+
+}
diff --git a/tests/src/Unit/OgAccessTestBase.php b/tests/src/Unit/OgAccessTestBase.php
index 8ac7ec545..eac63830a 100644
--- a/tests/src/Unit/OgAccessTestBase.php
+++ b/tests/src/Unit/OgAccessTestBase.php
@@ -23,6 +23,7 @@
 use Drupal\user\EntityOwnerInterface;
 use Drupal\user\RoleInterface;
 use Prophecy\Argument;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
 
 /**
  * Base class for tests of the OgAccess class.
@@ -180,6 +181,7 @@ protected function setUp(): void {
     $account_proxy = $this->prophesize(AccountProxyInterface::class);
     $module_handler = $this->prophesize(ModuleHandlerInterface::class);
     $this->permissionManager = $this->prophesize(PermissionManager::class);
+    $dispatcher = $this->prophesize(EventDispatcherInterface::class);
 
     // Instantiate the system under test.
     $this->ogAccess = new OgAccess(
@@ -188,7 +190,8 @@ protected function setUp(): void {
       $module_handler->reveal(),
       $this->groupTypeManager->reveal(),
       $this->permissionManager->reveal(),
-      $this->membershipManager->reveal()
+      $this->membershipManager->reveal(),
+      $dispatcher->reveal()
     );
 
     $container = new ContainerBuilder();