Drupal Expert

• Drupal 10/11 compatibility
• Security coverage (green shield icon)
• Last commit date (active maintenance?)
• Number of sites using it
• Issue queue responsiveness
• Whether it's covered by Drupal's security team

Ask these questions:

• Is there a well-maintained contrib module for this?
• Can an existing module be extended rather than building from scratch?
• Is there a Drupal Recipe (10.3+) that bundles this functionality?
• Would a patch to an existing module be better than custom code?

Core Principles

1. Follow Drupal Coding Standards

• PSR-4 autoloading for all classes in src/
• Use PHPCS with Drupal/DrupalPractice standards
• Proper docblock comments on all functions and classes
• Use t() for all user-facing strings with proper placeholders:
  • @variable - sanitized text
  • %variable - sanitized and emphasized
  • :variable - URL (sanitized)

2. Use Dependency Injection

• Never use \Drupal::service() in classes - inject via constructor
• Define services in *.services.yml
• Use ContainerInjectionInterface for forms and controllers
• Use ContainerFactoryPluginInterface for plugins

// WRONG - static service calls
class MyController {
  public function content() {
    $user = \Drupal::currentUser();
  }
}

// CORRECT - dependency injection
class MyController implements ContainerInjectionInterface {
  public function __construct(
    protected AccountProxyInterface $currentUser,
  ) {}

  public static function create(ContainerInterface $container) {
    return new static(
      $container->get('current_user'),
    );
  }
}

3. Hooks vs Event Subscribers

Both are valid in modern Drupal. Choose based on context:

Use OOP Hooks when:

• Altering Drupal core/contrib behavior
• Following core conventions
• Hook order (module weight) matters

Use Event Subscribers when:

• Integrating with third-party libraries (PSR-14)
• Building features that bundle multiple customizations
• Working with Commerce or similar event-heavy modules

// OOP Hook (Drupal 11+)
#[Hook('form_alter')]
public function formAlter(&$form, FormStateInterface $form_state, $form_id): void {
  // ...
}

// Event Subscriber
public static function getSubscribedEvents() {
  return [
    KernelEvents::REQUEST => ['onRequest', 100],
  ];
}

4. Security First

• Never trust user input - always sanitize
• Use parameterized database queries (never concatenate)
• Check access permissions properly
• Use #markup with Xss::filterAdmin() or #plain_text
• Review OWASP top 10 for Drupal-specific risks

Testing Requirements

Tests are not optional for production code.

Test Types (Choose Appropriately)

Test File Location

my_module/
└── tests/
    └── src/
        ├── Unit/           # Fast, isolated tests
        ├── Kernel/         # Service/entity tests
        └── Functional/     # Full browser tests

When to Write Each Type

• Unit tests: Pure PHP logic, utility functions, data transformations
• Kernel tests: Services, database queries, entity operations, hooks
• Functional tests: Forms, controllers, access control, user flows
• FunctionalJS tests: Dynamic forms, AJAX, JavaScript behaviors

Running Tests

# Run specific test
./vendor/bin/phpunit modules/custom/my_module/tests/src/Unit/MyTest.php

# Run all module tests
./vendor/bin/phpunit modules/custom/my_module

# Run with coverage
./vendor/bin/phpunit --coverage-html coverage modules/custom/my_module

Module Structure

my_module/
├── my_module.info.yml
├── my_module.module           # Hooks only (keep thin)
├── my_module.services.yml     # Service definitions
├── my_module.routing.yml      # Routes
├── my_module.permissions.yml  # Permissions
├── my_module.libraries.yml    # CSS/JS libraries
├── config/
│   ├── install/               # Default config
│   ├── optional/              # Optional config (dependencies)
│   └── schema/                # Config schema (REQUIRED for custom config)
├── src/
│   ├── Controller/
│   ├── Form/
│   ├── Plugin/
│   │   ├── Block/
│   │   └── Field/
│   ├── Service/
│   ├── EventSubscriber/
│   └── Hook/                  # OOP hooks (Drupal 11+)
├── templates/                 # Twig templates
└── tests/
    └── src/
        ├── Unit/
        ├── Kernel/
        └── Functional/

Common Patterns

Service Definition