Drupal 7 Module Development

Node Access
The reasoning behind this rule is that advanced access rules are more likely to be
applied to the View operation; many sites only require access restrictions on who can
view content because only editors and administrators may create content.
If you implement hook_node_access() on the View operation, you
are likely to alter the expected node access behavior in ways that make
debugging difficult for the site owner and other module developers.
Therefore, only node access modules should assert rules on the View
operation; access control modules should refrain from doing so.
If you think you must enforce View rules in hook_node_access(), please
clearly document that you have done so on your module's project page and
in an accompanying README.txt file.
When to write a node access module
Clearly, hook_node_access() is a very powerful function. As we have seen, many
common use-cases can be solved in just a few lines of code. So it is important for
module developers to consider when to use hook_node_access() to implement
access control as opposed to a complete node access module.
Since access control modules should not respond to the View operation, node access
modules become necessary any time you need to use access rules to restrict access
to the nodes that a user may view. The reason for this has to do with how Drupal
builds its access controls when listing nodes. hook_node_access() is only effective
for running access checks against individual nodes – a fact made clear by the fact that
the $node object is passed as a parameter.
However, hook_node_access() is no use to us when generating a list of nodes, for
three reasons:
• It provides no means to alter a node listing query to produce a proper list of
accessible nodes.
• Running an individual lookup function for every node on a page can be
resource intensive.
• An implementation of hook_node_access() can overrule the behavior
defined by other modules, which may not be desirable.
While it is tempting to solve all your access needs with hook_node_access(), doing
so limits the flexibility of your module. hook_node_access() is recommended for
single use-case modules, particularly those written for a specific site or project.
[ 260 ]