Drupal 7 Module Development

Drupal Permissions and Security
The second permission grants the ability to search site content using the default
search form. The third permission extends the second to include an additional
form for advanced searches.
The presence of these very specific permissions may seem odd, given that
there is an access content permission in the node module that grants
users the ability to view site content. However, search may be considered
a special case by some sites. Separating the search content permission
from the access content permission adds a layer of flexibility that
enables project customization.
People who complain that Drupal is too complex should consider this case for a
moment. From a site builder perspective, having three extra permissions means more
configuration work. However, imagine how frustrating it would be if you needed to
disable search for some users but could not (or could only do so programmatically).
In cases like these, Drupal almost always embraces flexibility. The presence of
multiple permissions in a core module means that someone has needed that
separation for a good reason. (In the next chapter, in fact, we will discuss the reason
for the bypass node access permission, which is a new feature in Drupal 7.)
Defining your module's permissions
Before writing any code for hook_permission(), it is the best practice to take out a
pen and paper (or a good diagramming program), and make a chart of the actions
you expect users to take. In fact, many experienced developers write this hook at the
end of development, after puzzling through all the use cases in the code.
Let's consider the preceding example module. It is very direct. We want to show
some information about users to trusted site administrators. Our use case looks
something like the following:
[ 218 ]