FileAccessControlHandler::checkAccess

protected FileAccessControlHandler::checkAccess(EntityInterface $entity, $operation, AccountInterface $account)

protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account) {
  /** @var \Drupal\file\FileInterface $entity */
  if ($operation == 'download' || $operation == 'view') {
    if (\Drupal::service('file_system')->uriScheme($entity->getFileUri()) === 'public') {
      // Always allow access to file in public file system.
      return AccessResult::allowed();
    }
    elseif ($references = $this->getFileReferences($entity)) {
      foreach ($references as $field_name => $entity_map) {
        foreach ($entity_map as $referencing_entity_type => $referencing_entities) {
          /** @var \Drupal\Core\Entity\EntityInterface $referencing_entity */
          foreach ($referencing_entities as $referencing_entity) {
            $entity_and_field_access = $referencing_entity->access('view', $account, TRUE)->andIf($referencing_entity->$field_name->access('view', $account, TRUE));
            if ($entity_and_field_access->isAllowed()) {
              return $entity_and_field_access;
            }
          }
        }
      }
    }
    elseif ($entity->getOwnerId() == $account->id()) {
      // This case handles new nodes, or detached files. The user who uploaded
      // the file can always access if it's not yet used.
      return AccessResult::allowed();
    }
  }

  if ($operation == 'delete' || $operation == 'update') {
    $account = $this->prepareUser($account);
    $file_uid = $entity->get('uid')->getValue();
    // Only the file owner can delete and update the file entity.
    if ($account->id() == $file_uid[0]['target_id']) {
      return AccessResult::allowed();
    }
    return AccessResult::forbidden();
  }

  // No opinion.
  return AccessResult::neutral();
}