>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3629633. --> Reported by: [rajeshreeputra](https://www.drupal.org/user/3418561) Related to !371 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>The Acquia DAM module is adding an opt-in <strong>single site authentication mode</strong>. In this mode, users with allowed roles can browse and select DAM assets with the site-level token, so they don't need to authenticate individually.</p> <p>The configuration form lets administrators turn this mode on and choose the allowed roles. However, the module's media and asset browsing code still ignores this setting. The auth service, client factory and consumers such as the asset library, categories controller and Views argument still call <code>getUserClient()</code> directly. Because of this, every user still has to complete user-level authentication, even when single site authentication is enabled and they have an allowed role.</p> <p>The authentication logic, client selection, route access and media library messages need to follow the single site authentication settings. If the feature is disabled, behaviour must stay exactly as it is today.</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Add the core logic for single site authentication across the auth service, client factory, route access and consumer code.</p> <h4>1. Auth service (<code>src/AcquiadamAuthService.php</code>)</h4> <ul> <li>Add <code>canUseSingleSiteAuth()</code>, which: <ol> <li>Checks that the feature is enabled.</li> <li>Gets the allowed roles from config.</li> <li>Checks whether the current user has any allowed role, using <code>array_intersect()</code>.</li> </ol> </li> <li>Add <code>userNeedsAuthentication()</code> to decide whether the user needs to authenticate individually.</li> <li>Update <code>shouldShowAuthorizationPrompt()</code> to use the new logic.</li> </ul> <h4>2. Client factory (<code>src/Client/AcquiaDamClientFactory.php</code>)</h4> <ul> <li>Add a new <code>getClient()</code> method that picks the right token: <ul> <li>It returns the <strong>site client</strong> if the user can use single site authentication.</li> <li>Otherwise, it returns the <strong>user client</strong>.</li> </ul> </li> </ul> <h4>3. Access check</h4> <ul> <li>Create <code>src/Access/DamAuthenticatedAccessCheck.php</code> for DAM routes.</li> <li>Grant access when the site is authenticated <strong>and</strong> either the user is authenticated or the user can use single site authentication.</li> <li>Register the service in <code>acquia_dam.services.yml</code>.</li> </ul> <h4>4. Consumer code</h4> <p>Replace <code>getUserClient()</code> with <code>getClient()</code> in:</p> <ul> <li><code>src/AssetLibraryBuilder.php</code></li> <li><code>src/Controller/AcquiaDamCategoriesController.php</code></li> <li><code>src/Plugin/views/argument_default/AssetTypeArgument.php</code></li> <li>Any other code that calls <code>getUserClient()</code> directly. Search the codebase to find them.</li> </ul> <h4>5. Media library messaging</h4> <ul> <li>Show a separate message to users who don't have an allowed role.</li> <li>Keep the existing auth prompt for users who aren't using single site authentication.</li> </ul> <h4>6. Caching</h4> <ul> <li>Add the <code>user.roles</code> cache context wherever decisions depend on roles.</li> <li>Add the <code>user</code> cache context for checks that depend on the individual user's authentication.</li> </ul> <h4>7. Constraints</h4> <ul> <li>Site authentication is still required in every case.</li> <li>The change is backward compatible. When the feature is disabled, behaviour doesn't change.</li> </ul> <h4>8. Testing</h4> <ul> <li>Unit tests for the <code>AcquiadamAuthService</code> methods, covering: <ul> <li>The feature disabled</li> <li>The feature enabled with different role configurations</li> <li>Users with and without allowed roles</li> </ul> </li> <li>Kernel tests for the access check service.</li> <li>Functional tests for media library access, covering: <ul> <li>A user with an allowed role, who sees no auth prompt</li> <li>A user without an allowed role, who sees the auth prompt</li> <li>The feature disabled, with the original behaviour</li> </ul> </li> </ul>