The new Autocreate Access module
When a client has a need or idea that other people might benefit from, it's a great opportunity to contribute a module back to the community. I recently created the new Autocreate Access module to solve a problem on a project where Drupal's autocomplete tagging widget for taxonomy terms didn't work as our client expected. Typically, Drupal sites utilise this field widget to allow users to create new categories for their content on the fly. However, our client wanted to prevent ordinary site visitors from being able to create new tags, but still be able to select from existing ones - whilst allowing privileged editors to create tags from the same widget.
Without this module, Drupal doesn't make that distinction between different kinds of users: either everyone who can use the widget can create new terms, or none of them can!
Drupal already has excellent access controls in place, using roles and permissions for granular control over what different kinds of visitors can see and do. It even includes specific CRUD permissions for each vocabulary of terms that this widget allows picking from. So all I needed to do was wire up the autocomplete tagging widget to respect the existing permission for creating terms in the vocabulary for these tags. Install the module, and then configure it in any fields you want to use it for: simply tick the 'Respect access' box on Drupal's configuration form for editing a field:
As the description beneath the checkbox in that screenshot implies - this applies to any entity, not just taxonomy terms! The 'Tags style' autocomplete widgets are most commonly used with taxonomy terms, but they can be used on any entity reference field. Given that access controls around other entity types often need to be tighter, I can see this being an important tool to allow the easy editing that this widget provides, without circumventing restrictions!
Under the hood, the autocomplete widget uses Drupal's entity_autocomplete form element, which uses an #autocreate property to control how unmatched tags should be handled. (Hence 'autocreate' in my module's name!) The field widget simply populates this with the vocabulary/bundle selected in the field configuration. The Autocreate Access module just adds a check to enforce that the #autocreate property is only set when the currently logged-in user actually has access to create those terms/entities.
You might think that perhaps Drupal should do this by default - and it's an open question that's been asked before which is probably worth addressing in core. But I can appreciate that many websites still want to allow easy free-tagging without having to think about permissions (or giving direct access to full standalone forms for creating terms). Changing that behaviour could break backwards-compatibility, which might not be worth the hassle of delivering a change within core. At least this new module now makes it easy to choose whether to respect vocab permissions when creating tags on the fly.
I've just tagged (get it?!) the first stable release of the new Autocreate Access module - please let me know how you get on with it or if you have any ideas for it!