Drupal 7 Module Development

Node Access
• The {node_access} table and its role
• Defining your module's access rules
• Using hook_node_access_records()
• Using hook_node_grants()
• Rebuilding the {node_access} table
• Modifying the behavior of other modules
• Using hook_node_access_records_alter()
• Using hook_node_grants_alter()
• Testing and debugging your module
• Using Devel Node Access
Node Access compared to user_access()
and other permission checks
Unlike user_access(), using the Node Access system is not a simple case of
implementing a specific permission check before executing your code.
As we saw in the last chapter, user_access() determines what code may be
executed for a specific user under a given set of conditions. Drupal's Node Access
system is similar, but must account for variable conditions within a given set of
nodes. For example, certain users may be allowed to edit any Basic page content
but not allowed to edit any Article content. This condition means that Drupal
must be able to distinguish among different properties of each node.
The Node Access API is a series of interrelated functions that provide a consistent
programming interface for making these types of access checks. Due to the flexible
nature of Drupal however, there are multiple ways to define and implement node
access control mechanisms.
How Drupal grants node permissions
As we mentioned in the introduction, there are four fundamental operations that
affect nodes: Create, View, Update and Delete. Collectively, these are referred to
as CRUD (where View is replaced by Read). When dealing with nodes, it is vital
to know which operation is being performed.
[ 242 ]