A contributor can re-use media from a media library— or not?

[mlncn]

We are looking at the logo field for #385 and ended up with the same question we had in #378 about images and audio for artifacts— is there any use case at all for a person accessing a media library to select from already-uploaded images, audio, or video?

@mikefortun @lindsaypoirier ?

Thanks!

[lindsaypoirier]

In the new version, we would like to have this fixed so that folks can add things from the media library (assuming that they can only see files associated with artifacts that have not be designated as private). Do artifact permissions sync with file permissions?

[MegaKeegMan]

I was just considering this question, myself. If files are uploaded to media entities, then we will need to control access to those media entities, as well as to the files uploaded to them. Adding this to my list.

[mlncn]

Oh right i did a bunch of research when i saw @lindsaypoirier's question last week, but it looks like GitHub lost my draft comment. There are two additional layers of access, as Keegan noted:

1. Passing on the artifact (node)'s permissions to the media item.
2. Preventing access to the actual file if someone does not have access to the media item.

Note that the equivalent to 2 is not a feature of the current sites— if you can guess a path to the file, you can see it. So only addressing 1 here, for now. (Once the media access is controlled, that's a matter of enabling and using private files.)

• Media Private Access does this with its Media permissions "Inherited from immediate parent" access mode, but is aggressively labeled experimental— still, if it works that may be the most straightforward solution and we can seek co-maintainership of the module.
• The core issue, Make private file access handling respect the full entity reference chain, has no patch to fix it (the old patches are only about adding a warning), but suggests a workaround by the module providing the original access control, Permissions by term, to also do access control for the associated media entities.

@MegaKeegMan i would say it is certainly worth filing an issue with Access Policy module. It already supports multiple entity types including (it seems?) media. There may already be a way to configure the module to do this, or the feature may be readily embraced by the amazingly responsive maintainer.

[MegaKeegMan]

New issue in access policy: https://www.drupal.org/project/access_policy/issues/3450482

[mlncn]

Now expected that we will not want to re-use media for any artifacts. From meeting notes:

Media re-use

Someone puts their bio up, and then we wanted do do a profile of that person as an image artifact this image is going to be used as some kind of a thumbnail somewhere else may take images for media out completely pdf files are used quite a lot. would it be a case of sharing this other file type?

People should typically not re-use an image or PDF directly; rather they reference the artifact that embodies the metadata for the image or PDF as well.

Right now, a reference will be a link to the original artifact. The PDF viewer is only on the original artifact.

An image artifact that is referenced does show on the referencing artifact (as Reva notes, they have a view mode for that already, same approach we will keep for all artifacts, view mode can be an image preview, a link, etc depending on the type of artifact).