Prepare release notes for upcoming 8.x-1.0-alpha6 release

[pfrenssen]

8.x-1.0-alpha6

This release adds support for Drupal 9.x and PHP 7.4, fixes a security vulnerability and has improved entity access.

There are some significant backwards compatibility breaks in this release, please refer to the dedicated section below.

Security fixes

• Users can still access 'subscribe' link directly for closed groups #694 Users should not be able to subscribe to closed groups

New features

• Split up OgAccess::userAccessEntity() into two methods #672 Provide dedicated methods to check for access on group content entity operations
• Provide "delete" entity operation access checks on group entities #674 Provide "delete" entity operation access checks on group entities
• Provide a hook for altering access on group content entity operations #675 Provide a hook for altering access on group content entity operations

Improvements

• Remove getAllGroupBundles and replace with getGroupMap #402 Replace GroupTypeManager::getAllGroupBundles() with ::getGroupMap()
• t() calls should be avoided in classes #543 Remove t() calls
• #3129354 Add Drupal 9 support #640 Support Drupal 9.0
• Add phpunit 7 condition to travis.yml #641 Drupal 9.0 compatibility: Use PHPUnit 7 for Drupal 9 builds
• Remove dead code in OgAccessHookTest #648 Remove dead code in OgAccessHookTest
• Drop support for Drupal 8.7.x #649 Drop support for Drupal 8.7.x
• Add support for Drupal 9.1 #650 Support Drupal 9.1
• Switch Travis CI integration to Github Apps #651 Switch CI integration to Github Apps
• Remove $ignore_admin flag on OgAccess::userAccess() #652 Remove $ignore_admin flag on OgAccess::userAccess()
• Remove static cache in OgAccess::userAccess() #654 Remove static cache in OgAccess::userAccess()
• Rename 'administer group' permission to 'administer organic groups' #657 Rename 'administer group' permission to 'administer organic groups'
• Drupal 9.1.x deprecation notice: AssertLegacyTrait::assertOptionSelected() is deprecated #662 Drupal 9.1 compatibility: AssertLegacyTrait::assertOptionSelected() is deprecated
• Do not fail 9.x.x builds on deprecation warnings #663 Drupal 9.1 compatibility: Do not fail 9.x builds on deprecation warnings
• Drop support for php 7.1 #665 Drop support for PHP 7.1
• Function ReflectionType::__toString() is deprecated #667 Drupal 9.1 compatibility: Function ReflectionType::__toString() is deprecated
• 667 Use PHPUnit 7 for testing #668 Use PHPUnit 7 for all builds
• Add support for php 7.4 #677 Add support for PHP 7.4
• OgRoleInterface should extend RoleInterface #682 OgRoleInterface now extends RoleInterface
• Cleanup OgMembership::preSave #685 Clean up OgMembership::preSave()
• Require the strict types declaration #688 Adopt the strict types declaration
• Fix deprecated license #690 Update SPDX licence identifier to the correct format
• Document why we are doing an interface check #697 Document why we are doing an interface check
• Document how OG handles access and permissions #693 Document how OG handles access and permissions

Bug fixes

• Other Groups field should respect bundles config #643 Other groups field ignoring bundles settings
• OgAccess::userAccess() doesn't differentiate between entity operations and group level permissions #659 OgAccess::userAccess() doesn't differentiate between entity operations and group level permissions
• Fixed grammar #666 Fix grammar
• Remove obsolete service definition #670 Remove obsolete service definition
• User access check should no longer accept operations, only permissions #671 User access check should no longer accept operations, only permissions
• Permission based access checks should return neutral if a permission is not granted #692 Permission based access checks should return neutral if a permission is not granted
• Fix PHP CS issues #700 Fix PHP CS issues
• Fix GroupSubscribeTest::testSubscribeAccess #720 Fix GroupSubscribeTest::testSubscribeAccess

Backwards compatibility breaks

• Support for PHP 7.1 has been dropped. There is at the moment no new code added that requires PHP 7.2 or higher, but we have stopped supporting and testing PHP 7.1. Drop support for php 7.1 #665
• The $ignore_admin flag on OgAccess::userAccess() has been removed. This was supported in D7 but barely used and it was currently unused in D8. Remove $ignore_admin flag on OgAccess::userAccess() #652
• The administer group permission has been renamed back to the original administer organic groups since it was conflicting with a permission from the Group module. Rename 'administer group' permission to 'administer organic groups' #657
• Some methods in OgAccess were unintentionally processing both group level permissions and entity operations. These have now been split into separate methods. This is restoring the original access handling as it was designed for Drupal 7. See OgAccess::userAccess() doesn't differentiate between entity operations and group level permissions #659 for the full low down.
  • Any code that was calling into OgAccess::userAccess() or OgAccess::userAccessEntity() and passing an entity operation (e.g. update, delete, ...) instead of a group level permission (e.g. subscribe without approval) should now call OgAccess::userAccessEntityOperation().
  • Any code that was calling into OgAccess::userAccess() and passing an entity operation (e.g. update, delete, ...) instead of a group level permission (e.g. subscribe without approval) should now call OgAccess::userAccessEntityOperation().
  • Any hook_og_user_access_alter() hook implementations that are expecting the $context['permission'] data to contain an entity operation (such as update or delete) rather than a permission (e.g. subscribe without approval) will no longer be called. This code should instead be placed in an event subscriber that listens to the GroupContentEntityOperationAccessEvent::EVENT_NAME event.
  • Any code that was calling into $entity->access() to check for group level permissions (e.g. subscribe without approval) rather than an entity operation (e.g. update, delete, ...) was working before but was in violation of the Drupal API and will need to be replaced with a call to OgAccess::userAccess().
• The method GroupTypeManager::getAllGroupBundles() was duplicating the functionality of two other methods and has been removed. All code that was calling ::getAllGroupBundles() without passing an argument should now call ::getGroupMap(). Code that was calling ::getAllGroupBundles($type) with an argument should now call ::getGroupBundleIdsByEntityType($type). Remove getAllGroupBundles and replace with getGroupMap #402
• Support for Drupal 8.7 has been dropped Drop support for Drupal 8.7.x #649

[pfrenssen]

Ready with the first draft. Unassigning.

[MPParsley]

@pfrenssen when would you like to release this?

[pfrenssen]

I just checked https://github.com/Gizra/og/milestone/4 and it seems we are pretty close to release! It seems we just need 2 tickets merged and do some coding standards love.

@claudiu-cristea has just now approved #692, and #693 is also in approved state even though some changes were done after the last approval. This is probably not blocking since it is a documentation issue. It is also not in the milestone, but since it is finished we can probably just merge it in and include it in the release.

So those 2 can probably be merged, and then there are only the coding standards of #700. There is a false positive that affects a few of our "smart" lines of code, but I think it is OK to ignore the coding standards check for these lines, as long as we leave a comment there explaining why we are skipping the checks.

[MPParsley]

@pfrenssen, all of these issues have been resolved and added to the release notes above:

• Permission based access checks should return neutral if a permission is not granted #692
• Document how OG handles access and permissions #693
• Fix PHP CS issues #700
• Fix GroupSubscribeTest::testSubscribeAccess #720

@amitaibu, @pfrenssen, I created a draft release for 8.x-1.0-alpha6.

[MPParsley]

I created the release on Github, see https://github.com/Gizra/og/releases/tag/8.x-1.0-alpha6

@amitaibu, can you push this on d.o?

[pfrenssen]

Thanks so much for handling this release!

[amitaibu]

@MPParsley Awesome work, and great release notes.

Release on d.o. will be published soon

[MPParsley]

It's now available on https://www.drupal.org/project/og/releases/8.x-1.0-alpha6

Thank you guys!