Technical Implementation Plan (Revised)
Built-to-last architecture with Drupal 11: Registration workflow, section groups, forums, and member directory
Core Complete
Drupal 11.2.7
Multi-Layer
Drupal-Native
Original Plan: Integrate existing Python/FileMaker-based part distribution software with Drupal via APIs. View the entire contents of the original plan here.
Revised Plan: Build everything natively in Drupal 11 using proven contrib modules.
Why: Better long-term maintainability, leverages Drupal's strengths (access control, user management, content workflows), eliminates complex API integration layer, and provides more flexibility for future enhancements.
November 7-9, 2025: Built core registration, groups, forums, directory (3 days)
November 10, 2025: Documentation and testing preparation. Added seasonal membership management planning (self-service keyword reactivation).
Next: Small group testing, then phased rollout
Result: Went from concept to working system in 3 days vs. original 12-week plan. Drupal-native approach is much faster.
Traditional open registration leads to spam. Email-only approval is slow and burdensome. We needed a system that:
Path: /user/register
Fields:
Validation:
Path: /admin/people/pending
Access: Registration Approver role
Features:
Approval Actions:
Management: /admin/config/acwe/rehearsal-keyword
How It Works:
Storage: Drupal state API (acwe.rehearsal_keyword), tracks who updated it and when
hook_form_alter() - Adds keyword field to registration formACWE has 4 seasons per year. Members may skip one or more seasons due to work, travel, health, or personal reasons. They should be able to take a break without losing their account and return seamlessly without re-registering.
Key Requirements: On-break members should not access Group content (especially music files), but can stay connected via forums. Members should be able to self-reactivate when they return.
The Solution: Leverage the existing rehearsal keyword system for seasonal reactivation.
/user/reactivateBenefits: Self-service (no admin overhead), proves attendance, reuses existing infrastructure, forces keyword refresh each season
On-Break Members CAN Access:
On-Break Members CANNOT Access:
New Field: field_member_status
Reactivation Form: /user/reactivate
field_primary_sectionSeason End Control:
Access Control Logic:
hook_user_update() - Toggles Group membershipfield_primary_section - admin can edit if member switches instrumentsFor Returning Members:
/user/reactivateFor Active Members at Season End: Account automatically set to on_break. Simply reactivate with new keyword when next season begins. This maintains tight access control and ensures everyone has the current keyword.
field_member_status - User field (list_string, 2 values)hook_user_update() - Auto Group membership toggleWe use the Groups module (v3.3.5) - one of Drupal's most mature and well-maintained contrib modules. It provides flexible group-based access control.
Why Groups Module: Battle-tested, supports complex permissions, integrates with all Drupal entities, will easily extend to music file management in Phase 2.
Process:
field_primary_section$group->addMember($user)Flexibility:
field_primary_section and Group Membership are Separate
The section field is for display/categorization. Group membership controls access. They're only linked automatically at registration. This provides flexibility:
Forums serve as the replacement for the old Freelists.org email list. They provide threaded discussions, better spam control, and integrated access with the rest of the portal.
Key Feature: Members-only access. Anonymous users cannot see any forum content.
1. Announcements Container
2. General Container
3. Section Forums Container
Authenticated Users:
Registration Approvers (Section Leaders):
Two-Layer Protection:
1. Node Access (Content Level)
hook_node_access()2. Page Redirect (Forum Pages)
hook_preprocess_page()Shows only essential information: Name, Section, Member Since. No email addresses or phone numbers to prevent spam harvesting.
Path: /members/directory
Display Format: Table
Columns:
Filters:
Other Features:
Issue Solved: Default Views table had poor contrast (white text on light gray)
Solution: Custom CSS in theme
Styling Features:
Location:
acwe2025_bootstrap/css/style.cssWe implemented a defense-in-depth approach with four independent layers. Each layer catches different types of threats.
Type: Invisible background scoring
Configuration:
Enabled On:
How It Works: Google scores user behavior (mouse movement, timing, browser fingerprint). Scores below threshold are blocked.
Honeypot:
Antibot:
Effect: Catches automated bots that don't execute JavaScript or fill forms too quickly.
Custom Verification Question
Concept:
Effect:
Human Review (Final Barrier)
Process:
Effect:
These four layers work together:
User Experience: Legitimate members experience minimal friction (keyword + invisible reCAPTCHA), while spam is effectively eliminated.
Core Functionality:
drupal/group (v3.3.5) - Section groupsdrupal/gnode - Group Node integrationdrupal/forum - Forum systemAnti-Spam & Security:
drupal/recaptcha - reCAPTCHA v3drupal/honeypot - Bot trapdrupal/antibot - Bot detectiondrupal/flood_control - Rate limitingUser Management:
drupal/pathauto - URL aliasesdrupal/token - Token systemdrupal/legal - Terms of Usedrupal/field_group - Field organizationAdmin Tools:
drupal/admin_toolbar - Enhanced menuCustom:
acwe_registration - Our custom moduleHigh Priority:
drupal/message - Notification systemdrupal/message_notify - Email notificationsdrupal/symfony_mailer_lite - Email handlingdrupal/easy_email - Email templatesdrupal/mailsystem - Mail configurationdrupal/contact_storage - Contact formsOptional:
drupal/pwa - Progressive Web App featuresdrupal/advanced_forum - No D11 supportdrupal/mailhandler - Not supported (reply-via-email)drupal/message_subscribe - Not D11.2.7 compatibledrupal/subscribe - Not security coveredOriginal Plan: Integrate existing Python/FileMaker system via API
Revised Plan: Build music management natively in Drupal using Group content
Rationale: Groups module is already in place, provides perfect access control foundation, eliminates API complexity, and offers more flexibility for future features.
Content Type: Sheet Music
Fields:
Group Integration:
Automatic Retention Management:
Admin Override:
Audit Trail:
Estimated Time: 2-3 weeks (after core features are fully tested)
modules/custom/acwe_registration/
├── acwe_registration.info.yml (Module metadata)
├── acwe_registration.module (Hooks: form_alter, node_access, preprocess)
├── acwe_registration.routing.yml (Routes for approval dashboard, keyword config)
├── acwe_registration.permissions.yml (Custom permissions)
├── src/
│ ├── Controller/
│ │ └── PendingRegistrationsController.php (Approval dashboard)
│ └── Form/
│ ├── ApproveUserForm.php (Approval confirmation with group assignment)
│ ├── DenyUserForm.php (Denial confirmation)
│ └── KeywordSettingsForm.php (Keyword management)
└── config/
└── install/
└── acwe_registration.settings.yml (Default config)
All core features are complete and tested. The system is ready for a small group pilot (5-10 users) to validate the workflow before broader rollout.
Next Step: Set the rehearsal keyword, identify test users, and run through the complete registration → approval → forum posting → directory workflow.