Drupal 7 Module Development

Node Access
->limit(variable_get('default_nodes_main', 10))
->addTag('node_access');
$nids = $select->execute()->fetchCol();
This select statement uses Drupal 7's query builder to fetch a list of published nodes
which have been promoted to the front page, ordered by "stickiness" and age. Notice,
however, the final element of the query: ->addTag('node_access').
This directive invokes the node_query_node_access_alter() function which
allows node access rules to be applied before the query is sent to the database.
Failure to use the dynamic query builder and the node_access tag will mean that
your select statement will bypass Drupal's built-in security features. Doing so may
grant unwanted access to view, edit, or delete content by ignoring the permissions
defined for the site.
We won't go into the inner workings of node_query_node_access_alter() yet.
Simply put, it ensures that any query to the {node} table properly enforces the node
access rules defined for the site.
Because of how this enforcement is handled, however, module developers have a
near-infinite capacity to modify how Drupal handles access to nodes. The purpose
of the rest of this chapter is to explain how this system is designed and the best ways
for you to leverage the Node Access API to meet your specific needs.
The node_access() function
node_access() is the primary access callback for node operations. It is defined in
node_menu() as the access callback for any attempt to create, view, edit or delete
a node. The function itself is one of the more complex in Drupal core by virtue of
the eight separate return statements within the function. Understanding the logic
behind these returns is the key to using Node Access correctly.
To begin, let's examine the documentation and initial lines of the
node_access() function:
/**
* Determine whether the current user may perform the given operation
* on the specified node.
*
* @param $op
* The operation to be performed on the node. Possible values are:
* - "view"
* - "update"
[ 244 ]