by Jeff Eaton

Module Monday: Guest Pass

Drupal's permission and access control system allows you to carefully control what functionality and content can be seen by different classes of users. Sometimes, though, your carefully constructed access rules can be a hindrance. What happens when you want to give just a few users temporary access to areas of the site that are normally off-limits? Letting your boss preview a new feature with a throwaway account can be useful, for example, but keeping track of those temporary accounts and ensuring that you clean them up when they're no longer needed can be a real pain. Guest Pass module solves that problem by giving privileged users the right to invite and manage special time-limited "guest accounts."

Screenshot of Guest Pass creation

Setting up Guest Pass is straightforward: drop it in, install it, and choose which user roles have the right to create new guest passes. On nodes that they own, these users will see a special "Guest Pass" tab: on it, they can create new passes by entering an email address and invitation message. The module generates a unique invitation URL and sends off an email. Once the recipient visits that URL, a fresh new Drupal user account is created for them automatically, they're granted the "Guest" user role, and redirected to the node that the guest pass was created for. Using Drupal's permissions system, you can control what content and site features those guests are able to use.

Screenshot of Guest Pass invitation email

The global Guest Pass settings page allows administrators to control which content types guest passes can be used with, the verbiage of the default invitation message, as well as the mechanism for cleaning up old guest accounts. The users who created each guest pass can go back and delete the passes (and their matching guest accounts) manually, but the module can also clean up old guest passes every few days.

Screenshot of Guest Pass administration options

The module does have some idiosyncrasies. Although guest passes are created and associated with specific nodes, they do not have any connection to per-node access controls. Every guest user who receives a pass will have the same access permissions, so there's no way to give one guest access to one node while keeping it hidden from another. It might make sense to decouple the creation of guest passes from the node page entirely, or to use Drupal 7's more robust access controls to give Guests special access just to nodes they received an explicit invitation for. In addition, there's no easy way for a user to "upgrade" a guest pass to a full user account if they want to stay. That's no problem for temporary previewing, but it makes it less useful as a tool for inviting potential new users.

Those issues aside, Guest Pass is a great tool for giving specific trusted people time-limited access to special areas of your site. Check it out!

newsletter-bot