Defining permissions and checking whether a user has access

In Drupal, roles and permissions are used to define robust access control lists for users. Modules use permissions to check whether the current user has access to perform an action, view specific items, or do other operations. Modules then define the permissions that are used so that Drupal is aware of them. Developers can then construct roles, which are made up of enabled permissions.

In this recipe, we will define new permission(s) in a module that is used to check if the user can mark content as promoted to the front page or sticky at the top of lists. This permission will be used in an entity field access hook to deny access to the fields if the user is missing the permission.

Getting ready

Create a new module, as we did in the first recipe. We will refer to the module as mymodule throughout this recipe. Use your module’s name in the following recipe as appropriate.

Create a new Drupal user with the...