drupal-dev-patterns

name	drupal-dev-patterns
description	Hook implementations, service/DI patterns, and security patterns for Drupal 10/11. Use when implementing hooks, form alters, event subscribers, creating services, working with dependency injection, or reviewing code for security issues.

Drupal Development Patterns

Announce at start: "I'm using the drupal-dev-patterns skill for [hooks/DI/security] guidance."

IRON LAW: NO \Drupal:: STATIC CALLS IN SERVICE CLASSES. Use constructor injection.

This skill covers three domains. Load only the reference you need:

Hook Patterns

OOP hooks with #[Hook] attribute (Drupal 11+), legacy bridges, form alters, entity hooks, theme hooks, event subscribers, install/update hooks.

Full reference: references/hook-patterns.md

Quick decision:

• Drupal 11+? Use #[Hook] attribute in a Hook class
• Need Drupal 10 compat? Add #[LegacyHook] bridge in .module
• Business logic? Delegate to an injectable service, not the hook class

Service & Dependency Injection

Service definitions, constructor property promotion, interface design, plugin DI, common Drupal services table, service name discovery.

Full reference: references/service-di-patterns.md

Quick decision:

• Creating a service? Define in *.services.yml, use autowire where possible
• Injecting into a plugin? Implement ContainerFactoryPluginInterface
• Finding a service name? Read the module's *.services.yml directly

Security Patterns

SQL injection prevention, XSS protection, access control (route + entity), CSRF protection, file upload validation, security checklist.

Full reference: references/security-patterns.md

Quick decision:

• Database query? Use Entity API (best) or parameterized queries
• User output? Twig auto-escapes. For PHP: Html::escape() or Xss::filter()
• Route access? Stack _permission, _entity_access, custom checkers in routing.yml