Drupal 7 Module Development

In the first case, Are we looking at a user page? is a question our module does
not need to ask. We know through the API that using hook_user_view() only
fires when someone is looking at a user's information. So we don't need our own
permission check for that action.
What matters to us is the question Are we a trusted user? Here we may have
to create a permission check.
Chapter 8
We could simply use the existing administer users permission provided by core,
but is that the best solution? In many use cases, it is likely to be. However, suppose
you are building a newspaper website. In this scenario, we have "site editors" whose
job is to supervise the work of others. To do so, these editors need to be able to check
the content types that a user can create. However, administer users is a much more
powerful permission, which allows the editing of user accounts and the assigning of
user roles. We may not want to give that much authority and responsibility to our
site editors.
In this case—in fact, in most cases—the creation of a discrete permission for each
action is the best choice. Since you cannot reliably predict all the usage scenarios for
your code, piling too many actions onto a single permission can limit how people can
use your module. Any time you see yourself writing an administer X permission in
the code, you should ask yourself if that permission can be made more granular.
Writing hook_permission()
For our example module, then, we need to define a permission that grants the ability
to view this information about users. Our permission array is quite direct, and has
three possible parts:
1. The machine-readable name of the permission. This element will be used
by the module code to check user_access(). For our example, we use the
string "view content creation permissions". By convention, this string must
be in English and all lower case. It need not be a complete sentence.
2. The human-readable label for the permission. This may be the same as the
machine-readable string, but should be formatted with an initial capital.
You may capitalize words as needed. Unlike the machine-readable name,
this string must be wrapped in t() so that the output may be translated.
We will use "View the content creation options for registered users" because
anonymous users do not have an account page to view.
[ 219 ]