Check group content entity operation access

og.services.yml

@@ -1,7 +1,7 @@
 services:
   og.access:
     class: Drupal\og\OgAccess
-    arguments: ['@config.factory', '@current_user', '@module_handler']
+    arguments: ['@config.factory', '@current_user', '@module_handler', '@og.group.manager', '@og.permission_manager']
   og.event_subscriber:
     class: Drupal\og\EventSubscriber\OgEventSubscriber
     arguments: ['@og.permission_manager', '@entity_type.manager', '@entity_type.bundle.info']

src/Entity/OgMembership.php

@@ -192,7 +192,7 @@ public function getRoles() {
   /**
    * {@inheritdoc}
    */
-  public function setRoles(array $roles = array()) {
+  public function setRoles(array $roles = []) {
     $role_ids = array_map(function (OgRole $role) {
       return $role->id();
     }, $roles);
@@ -215,6 +215,11 @@ public function getRolesIds() {
    * {@inheritdoc}
    */
   public function hasPermission($permission) {
+    // Blocked users do not have any permissions.
+    if ($this->getState() === OgMembershipInterface::STATE_BLOCKED) {
+      return FALSE;
+    }
+
     return array_filter($this->getRoles(), function (OgRole $role) use ($permission) {
       return $role->hasPermission($permission);
     });
@@ -255,10 +260,10 @@ public static function baseFieldDefinitions(EntityTypeInterface $entity_type) {
       ->setLabel(t('Group entity id.'))
       ->setDescription(t("The entity ID of the group."));
 
-    $fields['state'] = BaseFieldDefinition::create('integer')
+    $fields['state'] = BaseFieldDefinition::create('string')
       ->setLabel(t('State'))
-      ->setDescription(t("The state of the group content."))
-      ->setDefaultValue(TRUE);
+      ->setDescription(t('The user membership state: active, pending, or blocked.'))
+      ->setDefaultValue(OgMembershipInterface::STATE_ACTIVE);
 
     $fields['roles'] = BaseFieldDefinition::create('entity_reference')
       ->setLabel(t('Roles'))

src/Entity/OgRole.php

@@ -3,6 +3,7 @@
 namespace Drupal\og\Entity;
 
 use Drupal\Core\Config\ConfigValueException;
+use Drupal\Core\Entity\EntityInterface;
 use Drupal\og\Exception\OgRoleException;
 use Drupal\og\OgRoleInterface;
 use Drupal\user\Entity\Role;
@@ -36,6 +37,16 @@
  */
 class OgRole extends Role implements OgRoleInterface {
 
+  /**
+   * Constructs an OgRole object.
+   *
+   * @param array $values
+   *   An array of values to set, keyed by property name.
+   */
+  public function __construct(array $values) {
+    parent::__construct($values, 'og_role');
+  }
+
   /**
    * Sets the ID of the role.
    *
@@ -198,15 +209,23 @@ public function setName($name) {
     return $this;
   }
 
+  /**
+   * {@inheritdoc}
+   */
+  public static function loadByGroupAndName(EntityInterface $group, $name) {
+    $role_id = "{$group->getEntityTypeId()}-{$group->bundle()}-$name";
+    return self::load($role_id);
+  }
+
   /**
    * {@inheritdoc}
    */
   public function save() {
     // The ID of a new OgRole has to consist of the entity type ID, bundle ID
     // and role name, separated by dashes.
     if ($this->isNew() && $this->id()) {
-      list($entity_type_id, $bundle_id, $name) = explode('-', $this->id());
-      if ($entity_type_id !== $this->getGroupType() || $bundle_id !== $this->getGroupBundle() || $name !== $this->getName()) {
+      $pattern = preg_quote("{$this->getGroupType()}-{$this->getGroupBundle()}-{$this->getName()}");
+      if (!preg_match("/$pattern/", $this->id())) {
         throw new ConfigValueException('The ID should consist of the group entity type ID, group bundle ID and role name, separated by dashes.');
       }
     }
@@ -257,6 +276,7 @@ public function set($property_name, $value) {
       'group_type',
       'group_bundle',
     ]);
+
     if (!$is_locked_property || $this->isNew()) {
       return parent::set($property_name, $value);
     }

src/GroupContentOperationPermission.php

@@ -43,7 +43,7 @@ class GroupContentOperationPermission extends Permission {
    *   FALSE if this permission applies to all entities, TRUE if it only applies
    *   to the entities owned by the user.
    */
-  protected $owner = 'any';
+  protected $owner = FALSE;
 
   /**
    * Returns the group content entity type ID to which this permission applies.

src/GroupManager.php

@@ -239,7 +239,7 @@ public function getGroupContentBundleIdsByGroupBundle($group_entity_type_id, $gr
   }
 
   /**
-   * Sets an entity type instance as being an OG group.
+   * Declares a bundle of an entity type as being an OG group.
    *
    * @param string $entity_type_id
    *   The entity type ID of the bundle to declare as being a group.

src/Og.php

@@ -10,7 +10,6 @@
 use Drupal\field\Entity\FieldStorageConfig;
 use Drupal\field\FieldStorageConfigInterface;
 use Drupal\og\Entity\OgMembership;
-use Drupal\og\Entity\OgRole;
 
 /**
  * A static helper class for OG.
@@ -249,15 +248,18 @@ public static function getMemberships(AccountInterface $user, array $states = [O
    *   (optional) Array with the state to return. Defaults to active.
    *
    * @return \Drupal\og\Entity\OgMembership|null
-   *   The OgMembership entity, or NULL if the user is not a member of the
-   *   group.
+   *   The OgMembership entity. NULL will be returned if no membership is
+   *   available that matches the passed in $states.
    */
   public static function getMembership(EntityInterface $group, AccountInterface $user, array $states = [OgMembershipInterface::STATE_ACTIVE]) {
     foreach (static::getMemberships($user, $states) as $membership) {
       if ($membership->getGroupEntityType() === $group->getEntityTypeId() && $membership->getGroupId() === $group->id()) {
         return $membership;
       }
     }
+
+    // No membership matches the request.
+    return NULL;
   }
 
   /**
@@ -603,23 +605,6 @@ public static function groupManager() {
     return \Drupal::service('og.group.manager');
   }
 
-  /**
-   * Get a role by the group's bundle and role name.
-   *
-   * @param string $entity_type_id
-   *   The group entity type ID.
-   * @param string $bundle
-   *   The group bundle name.
-   * @param string $role_name
-   *   The role name.
-   *
-   * @return \Drupal\og\OgRoleInterface|null
-   *   The OG role object, or NULL if a matching role was not found.
-   */
-  public static function getRole($entity_type_id, $bundle, $role_name) {
-    return OgRole::load($entity_type_id . '-' . $bundle . '-' . $role_name);
-  }
-
   /**
    * Return the og permission handler instance.
    *
@@ -696,7 +681,7 @@ protected static function getFieldBaseDefinition($plugin_id) {
    * @param array $options
    *   Overriding the default options of the selection handler.
    *
-   * @return OgSelection
+   * @return \Drupal\og\Plugin\EntityReferenceSelection\OgSelection
    *   Returns the OG selection handler.
    *
    * @throws \Exception