Drupal 7 Module Development

Chapter 9
For our test module, we want to leverage Drupal's role system to create tiers of users.
Each member of a role will only be able to View, Edit, or Delete content created by
other members of that role. Some users, however, may not be allowed to Edit or
Delete content, so our module needs to separate the three permissions properly.
Written out, here is what our rule set looks like:
1. All users will be assigned to one or more roles.
2. All nodes will be assigned grants based on the role(s) of the node author.
3. Users will be assigned individual grants for the View, Update, and Delete
actions based on their assigned roles and permissions.
4. Users with the proper permission will be able to View, Update, and Delete a
node, regardless of its publication state.
5. If the author of a node changes, the grants for that node will change.
6. If the author of a node is assigned new roles, the grants for the author's nodes
will not be altered unless the nodes are updated.
Remember:
These rules all seem pretty straightforward, except for
rule #6. To be honest, we put in rule #6 to prevent us from
having to write additional code to handle this case, which
would merely complicate our example. However, when
writing a node access module, you need to keep in mind all
the variables that may affect how your rule sets are enforced.
• Node access rules are recalculated and stored every time a node is saved
• User access grants are calculated for every page request
• Node access rules must be rebuilt for the entire site any time a node access
module is added or removed
• Node access grants may be different for each of the three operations – View,
Update, and Delete – even for the same user
Your module needs to be aware of the greater context in which its rules operate.
So writing out the expected behavior of the module – and posting that definition
in a README file and as online and module help documentation – is a key part
to writing a good node access module.
Based on the rules and guidelines above, we have a good idea how to write our
module. Let's call it Role Access and get to work.
[ 265 ]