Why implementation of node access for different content type breaks my other type access control?

Question

System architecture:

Main entities:

• Company
• Employee (and other user types)
• Document

References:

• Every document has reference to company and employee.
• Every employee has reference to company also (at least one company)

I've implemented custom access control for documents, which suppose to working fine (my unit tests gives me all green also).

Now I'm creating View - documents list for an employee. Basic version of View is working correct. I want to add exposed filter for a company. By default this is a list of all companies. But I want to restrict this list only for companies from employee documents, related to current logged in employee.

Code:

/**
 * Implements hook_node_access_records().
 */
function mymod_company_node_access_records($node) {
  if ($node->type <> myCompany::CONTENT_TYPE_NAME) {
    return array();
  }

  return array(
    array(
      'realm' => MYMOD_COMPANY_LOCK_NAME,
      'gid' => $node->nid,
      'grant_view' => 1,
      'grant_update' => 0,
      'grant_delete' => 0,
      'priority' => 0,
    )
  );
}

/**
 * Implements hook_node_grants().
 */
function mymoo_company_node_grants($account, $op) {
  if ($op <> 'view') {
    return array();
  }

  if (mymod_user_is_an_employee($account)) {

    $myUser = myUser::createFromUser($account);
    $companies = $sdUser->getCompanies();
    if (empty($companies)) {
      return array();
    }

    $grants = array();

    foreach(array_keys($companies) as $nid) {
      $grants[MYMOD_COMPANY_LOCK_NAME][] = $nid;
    }

    return $grants;

  } else {
    return array();
  }
}

Indeed filter list is restricted to employee related companies, but in my View, I'm seeing ALL documents related to these companies. Why?

My View main content type is Document. Company is related node via entity reference field. I don't understand why company access control has some type of precedence here.

Answer 1

While browsing through the Drupal docs about hook_node_access_records, I stumbled upon this comment:

Note that (as of 7.35) if your module and every other module in your installation implementing this hook return empty arrays, Drupal will automatically insert a record into the node_access table for the given node with GID 0, grant_view set to 1, and grand_update and grant_delete set to 0.

You can find it here (last comment).