A client recently asked me to figure out how to allow additional authors to not only be listed on a single node, but also to let them have the same edit and delete permissions as the main author of the node. I thought it might be helpful to put together an article that details one potential solution to this not completely uncommon task.

This is not something I have implemented in any modern version of Drupal (8, 9, or 10), so I took a fresh look at the problem by reaching out to my Drupal network via Slack and social media - I even asked ChatGPT (with poor results in this case.) I received several suggestions, including the very new Node Co-Authors module, the not-at-all-new Access by Reference module, and the full-of-momentum ECA module.

I also decided to use this as a topic of discussion during the weekly DrupalEasy office hours (exclusively available to our long-form training course students and graduates.) I did some initial research and decided to try the Access by Reference module first - mainly because it seemed rather flexible as well as straight-forward to use. I really liked the fact that I could configure it to use any user reference field I add to a particular content type to specify additional authors.

The Access by Reference module allows you to specify additional authors via several methods, including via a reference field (this is the obvious choice, IMHO,)  user email address, a shared profile value, or via a reference parent (interesting) For this use case, via a user reference field was exactly what I was looking for.

Spinning up a fresh Drupal 9 install to test it on, I installed the Access by Reference module and added a standard multi-valued "Additional authors" entity reference field on the Basic page content type (image above).

Next, I navigated to the "Set access by reference" configuration area and added a new "abr configuration." This is where I told the Access by Reference module about the user reference field I had just added. Setup was pretty straight forward:
 

There really wasn't anything tricky to setting up the abr configuration. I basically pointed to the "Additional authors" field I added, set the "Reference type," and then specified that I wanted additional authors to inherit read, update and delete permissions from the main author. Easypeasy.

The final step was to give the "Access By Reference" permission to the role of users I wanted to be able to become additional authors. For example, by giving this permission to "Authenticated users", then any user can be added as an additional author for a particular node and then have edit and delete permissions for the node (probably not the best configuration.)  In my client's case, they have something akin to an "authors" role that makes perfect sense for this scenario.

While this completed the functional aspect of the task, I really wanted the "Additional authors" field to be listed in the "Authoring information" accordion of a standard Drupal node add/edit form (when using Claro). This was accomplished with a very small custom Drupal module (named multiauthor) that implements a single Drupal hook:
 

/**
* Implements hook_form_alter().
*/
function multiauthor_form_alter(array &$form, FormStateInterface $form_state, string $form_id): void {
if (in_array($form_id, ['node_page_edit_form', 'node_page_form'])) {
$form['field_additional_authors']['#group'] = 'author';
}
}

This hook alters the Basic page add and edit forms, setting my custom "Additional author" field (field_additional_authors) to the "author" group (this is the "Additional authors" accordion).

With that in place, the somewhat elegant solution is complete.
 

At this point, any users added to the "Additional authors" field will have the same read, update, and delete permissions at the owner of the node. Success!