Drupal 7 Module Development

Node Access
The access whitelist
The first check that node_access() makes is to see if the callback was
invoked correctly:
if (!$node || !in_array($op, array('view', 'update', 'delete',
'create'), TRUE)) {
// If there was no node to check against, or the $op was not one
// of the supported ones, we return access denied.
return FALSE;
}
This code displays a bit of paranoia not found in most of the Drupal API. Checking
the validity of the inbound parameters ensures that access is never granted by accident.
When dealing with access control, defaulting to FALSE (meaning "deny access") is
the proper behavior.
Caching the result for performance
The next section of code performs three simple sanity checks, plus an optimization
for the static cache:
// If no user object is supplied, the access check is for the
// current user.
if (empty($account)) {
$account = $user;
}
// $node may be either an object or a node type. Since node types
// cannot be an integer, use either nid or type as the static
// cache id.
$cid = is_object($node) ? $node->nid : $node;
// If we've already checked access for this node, user and op,
// return from cache.
if (isset($rights[$account->uid][$cid][$op])) {
return $rights[$account->uid][$cid][$op];
}
if (user_access('bypass node access', $account)) {
$rights[$account->uid][$cid][$op] = TRUE;
return TRUE;
}
[ 246 ]