Drupal 7 Module Development

Chapter 9
hook_node_access() is the simpler of the two systems. It is a self-contained hook that
allows individual access control modules to pass judgment on a node. Note, however,
that in Drupal core its use is limited to only three of the four node operations: Create,
Update and Delete. We can see this clearly in node.module's implementation:
/**
* Implements hook_node_access().
*/
function node_node_access($node, $op, $account) {
$type = is_string($node) ? $node : $node->type;
if (in_array($type, node_permissions_get_configured_types())) {
if ($op == 'create' && user_access('create ' . $type . ' content',
$account)) {
return NODE_ACCESS_ALLOW;
}
if ($op == 'update') {
if (user_access('edit any ' . $type . ' content', $account) ||
(user_access('edit own ' . $type . ' content', $account) && ($account-
>uid == $node->uid))) {
return NODE_ACCESS_ALLOW;
}
}
if ($op == 'delete') {
if (user_access('delete any ' . $type . ' content', $account)
|| (user_access('delete own ' . $type . ' content', $account) &&
($account->uid == $node->uid))) {
return NODE_ACCESS_ALLOW;
}
}
}
}
return NODE_ACCESS_IGNORE;
Because hook_node_access() fires before checking the {node_access} table, it
is used to define the default behavior for node permissions. This behavior is very
useful for items like creating and editing content according to node type, but it can
be very limiting when defining the rules for viewing a node. For that reason, Drupal
core never asserts a value on the View operation for a node.
[ 251 ]