Do the role-specific things.

src/Plugin/search_api/processor/DgiImageDiscovery.php

@@ -4,12 +4,15 @@
 
 use Drupal\Core\Entity\EntityTypeManagerInterface;
 use Drupal\Core\Plugin\ContainerFactoryPluginInterface;
+use Drupal\Core\Session\AccountSwitcherInterface;
+use Drupal\Core\Session\UserSession;
 use Drupal\dgi_image_discovery\ImageDiscoveryInterface;
 use Drupal\dgi_image_discovery\Plugin\search_api\processor\Property\DgiImageDiscoveryProperty;
 use Drupal\node\NodeInterface;
 use Drupal\search_api\Datasource\DatasourceInterface;
 use Drupal\search_api\Item\ItemInterface;
 use Drupal\search_api\Processor\ProcessorPluginBase;
+use Drupal\user\RoleInterface;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 
 /**
@@ -42,6 +45,13 @@ class DgiImageDiscovery extends ProcessorPluginBase implements ContainerFactoryP
    */
   protected $imageDiscovery;
 
+  /**
+   * Drupal's account switcher service.
+   *
+   * @var \Drupal\Core\Session\AccountSwitcherInterface
+   */
+  protected AccountSwitcherInterface $accountSwitcher;
+
   /**
    * {@inheritdoc}
    */
@@ -62,13 +72,17 @@ public function __construct(
    * {@inheritdoc}
    */
   public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
-    return new static(
+    $instance = new static(
       $configuration,
       $plugin_id,
       $plugin_definition,
       $container->get('dgi_image_discovery.service'),
       $container->get('entity_type.manager')
     );
+
+    $instance->accountSwitcher = $container->get('account_switcher');
+
+    return $instance;
   }
 
   /**
@@ -99,29 +113,49 @@ public function addFieldValues(ItemInterface $item) {
     $value = NULL;
 
     // Get the image discovery URL.
-    if (!$entity->isNew() && $entity instanceof NodeInterface) {
-      $event = $this->imageDiscovery->getImage($entity);
-      $media = $event->getMedia();
-      if (empty($media)) {
-        return;
-      }
-
-      $media_source = $media->getSource();
-      $file_id = $media_source->getSourceFieldValue($media);
-      $image = $this->entityTypeManager->getStorage('file')->load($file_id);
-      if (empty($image)) {
-        return;
-      }
+    if (!(!$entity->isNew() && $entity instanceof NodeInterface)) {
+      return;
+    }
 
-      $fields = $item->getFields(FALSE);
-      $fields = $this->getFieldsHelper()->filterForPropertyPath($fields, NULL, 'dgi_image_discovery');
-      foreach ($fields as $field) {
-        $config = $field->getConfiguration();
-        $image_style = $config['image_style'];
-        $value = $this->entityTypeManager->getStorage('image_style')->load($image_style)
+    $fields = $item->getFields(FALSE);
+    $fields = $this->getFieldsHelper()->filterForPropertyPath($fields, NULL, 'dgi_image_discovery');
+    foreach ($fields as $field) {
+      try {
+        $configuration = $field->getConfiguration();
+
+        // XXX: Adapted from https://git.drupalcode.org/project/search_api/-/blob/8.x-1.x/src/Plugin/search_api/processor/RenderedItem.php#L184-190
+        // If a (non-anonymous) role is selected, then also add the authenticated
+        // user role.
+        $roles = $configuration['roles'] ?? [RoleInterface::ANONYMOUS_ID];
+        $authenticated = RoleInterface::AUTHENTICATED_ID;
+        if (array_diff($roles, [$authenticated, RoleInterface::ANONYMOUS_ID])) {
+          $roles[$authenticated] = $authenticated;
+        }
+
+        $this->accountSwitcher->switchTo(new UserSession(['roles' => array_values($roles)]));
+
+        $event = $this->imageDiscovery->getImage($entity);
+        $media = $event->getMedia();
+        if (empty($media)) {
+          continue;
+        }
+
+        $media_source = $media->getSource();
+        $file_id = $media_source->getSourceFieldValue($media);
+        $image = $this->entityTypeManager->getStorage('file')->load($file_id);
+        if (empty($image)) {
+          continue;
+        }
+
+        $image_style = $configuration['image_style'];
+        $value = $this->entityTypeManager->getStorage('image_style')
+          ->load($image_style)
           ->buildUrl($image->getFileUri());
         $field->addValue($value);
       }
+      finally {
+        $this->accountSwitcher->switchBack();
+      }
     }
   }
 

src/Plugin/search_api/processor/Property/DgiImageDiscoveryProperty.php

@@ -3,9 +3,13 @@
 namespace Drupal\dgi_image_discovery\Plugin\search_api\processor\Property;
 
 use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Session\AccountInterface;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Drupal\search_api\Item\FieldInterface;
 use Drupal\search_api\Processor\ConfigurablePropertyBase;
+use Drupal\search_api\Utility\Utility;
+use Drupal\user\Entity\Role;
+use Drupal\user\RoleInterface;
 
 /**
  * Defines a "DGI Image Discovery" property.
@@ -20,6 +24,7 @@ class DgiImageDiscoveryProperty extends ConfigurablePropertyBase {
   public function defaultConfiguration() {
     return [
       'image_style' => 'solr_grid_thumbnail',
+      'roles' => [AccountInterface::ANONYMOUS_ROLE],
     ];
   }
 
@@ -37,6 +42,20 @@ public function buildConfigurationForm(FieldInterface $field, array $form, FormS
       '#default_value' => $configuration['image_style'],
     ];
 
+    // XXX: Copypasta from https://git.drupalcode.org/project/search_api/-/blob/8.x-1.x/src/Plugin/search_api/processor/Property/RenderedItemProperty.php?ref_type=heads#L41-52
+    $roles = array_map(function (RoleInterface $role) {
+      return Utility::escapeHtml($role->label());
+    }, Role::loadMultiple());
+    $form['roles'] = [
+      '#type' => 'select',
+      '#title' => $this->t('User roles'),
+      '#description' => $this->t('Your item will be rendered as seen by a user with the selected roles. We recommend to just use "@anonymous" here to prevent data leaking out to unauthorized roles.', ['@anonymous' => $roles[AccountInterface::ANONYMOUS_ROLE]]),
+      '#options' => $roles,
+      '#multiple' => TRUE,
+      '#default_value' => $configuration['roles'],
+      '#required' => TRUE,
+    ];
+
     return $form;
   }