Drupal 7 Module Development

Node Access
When executed, the following query is passed to the database:
SELECT n.nid FROM node n WHERE n.promote = 1 AND n.status = 1 ORDER BY
n.sticky DESC, n.created DESC LIMIT 0, 10;
The above query means:
Select the first ten distinct node ids for published and promoted nodes, ordered by
"stickiness" and age.
If we have a node access module enabled, however, hook_query_alter() will fire
the node_query_node_access_alter() function, which will rewrite the query by
adding a conditional JOIN to the node access table.
Drupal 7's database API uses the add_tag() method to register
hook functions. The value passed to the method – here node_access
– informs the name of the alter hook. Query alters take the format
hook_query_TAG_NAME_alter().
Our sample node access query looks like so after it has been processed by
node_query_node_access _alter():
SELECT DISTINCT(n.nid) FROM node n INNER JOIN node_access na ON n.nid
= na.nid WHERE (n.promote = 1) AND (n.status = 1) AND (((na.gid =
0) AND (na.realm = 'all')) OR (((na.gid = 2) AND (na.realm = 'role_
access'))) AND na.grant_view >= 1) ORDER BY n.sticky DESC, n.created
DESC LIMIT 0, 10;
In plain English, here's what it means:
Select the first ten distinct node ids for published and promoted nodes, ordered by
"stickiness" and age, provided that one of the following conditions is true: 1) The
default 'all users may view all nodes' rule is still in effect; or, 2) At least one of the
current user's access grants allows access to view the node.
That's a whole lot to take in, so we'll unpack it some more.
When node_query_node_access_alter() runs, it asks a few basic questions before
altering the query. These are:
• Can this user access all content?
This request is carried out by the node_access_view_all_nodes() function,
which checks to see if any node access modules are enabled, what the user's
permissions are, and if access is granted by the default 'view all content'
record. If TRUE, then the alter query exits without changing the query.
[ 262 ]