Mastering Drupal 10 and 11 Media Permissions: How to Implement a Powerful No-Code Solution

Mastering Drupal 10 and 11 Media Permissions: How to Implement a Powerful No-Code Solution

Drupal’s media management capabilities have improved significantly over the years, but one persistent limitation in Drupal 10 and Drupal 11 is the way media permissions are handled. By default, users either have view permissions for the entire Media entity or they don’t. This creates challenges for digital services that require restricted access to specific media types, such as private PDF files containing sensitive meeting minutes.

The Problem: Media Permissions in Drupal 10 & 11

By default, Drupal does not provide granular permissions for different media types. This means that anonymous users can either see all media entities or none at all. In scenarios where certain media types, such as PDFs, need to be restricted while others, like images and videos, remain publicly accessible, the default permission system falls short.

Common Solutions: Custom Modules & Hooks

A common recommendation found across various Drupal forums and even AI-generated responses is to create a custom module that utilizes the necessary hooks to control media access. While effective, this solution requires coding skills and an understanding of Drupal’s API—something that not all site administrators or content managers possess.

A Simpler Approach: Using the Field Permissions Module

Instead of writing custom code, a more accessible solution is to use the Field Permissions module. This module allows you to set permissions at the field level, meaning you can restrict access to specific fields within a media entity.

Steps to Implement Field-Based Media Permissions:

1. Install and enable the Field Permissions module
   
   • You can install it via Composer:

composer require drupal/field_permissions

• Then, enable it in Drupal:

drush en field_permissions -y

• Alternatively, you can install it through the Drupal admin UI:
  • Navigate to Extend in the Drupal admin panel.
  • Search for Field Permissions.
  • Check the box next to the module and click Install.

2. Configure Media Entity Permissions
   
   • Navigate to Structure > Media types in the Drupal admin panel.
   • Click on the media type you want to restrict access to (e.g., PDF Documents).
   • Under the Manage Fields tab, locate the field that stores the file (e.g., the File field for PDF documents).
   • Click Edit next to the relevant field.
   • Scroll down to the Field Permissions section.
   • Under View field permissions, check Authenticated users while leaving anonymous users unchecked.
   • Save the field settings.
   • If needed, apply similar permissions to other fields within the media type.
   • Clear the cache to apply changes:

drush cr

• Test the configuration by logging in as an authenticated user and an anonymous user to verify access restrictions.

Extending This to Paragraphs

The Field Permissions module is not just limited to media entities—it can also be applied to Paragraph Types within nodes. This provides an alternative to managing Paragraph Type permissions at the entity level. By securing fields instead of the entire Paragraph Type, you gain the flexibility to use paragraphs in both public and private content types, depending on their placement within the site structure.

Conclusion

If you’re managing a digital service that requires some media to be publicly accessible while restricting access to other types, the Field Permissions module provides an elegant, code-free solution. Instead of creating custom modules, simply setting field-level permissions ensures that private content, such as PDF meeting minutes, is only visible to authenticated users while still allowing anonymous users to access other media types.

This approach simplifies media access control in Drupal 10 and 11, making it a practical solution for administrators without extensive development expertise.