I'm trying to bypass some of the permissions set by Workbench Moderation, only under specific circumstances. For a specific content type, I need the users of a specific Role to be able to: - View all Published nodes of that content type (this works fine as it is quite general) - View Unpublished nodes only if the nodes 1. are related to them (through Entity Reference field) or 2. they have created themselves. - Edit nodes only if they are related to them (through Entity Reference field) or nodes they have created themselves. This should be allowed only in a specific State.
I've tried implementing hook_node_access_records() & hook_node_grants() hooks in my module but this doesn't seem to work. In the following example, the conditionals are different than what's mentioned above but the logic is the same:
function mymodule_node_access_records($node){
$grants = array();
if ($node->nid == 1234 && $node->uid == 99) { //(example conditions)
$grants[] = array(
'realm' => 'mymodule',
'gid' => 123,
'grant_view' => 1,
'grant_update' => 0,
'grant_delete' => 0,
'priority' => 0,
);
}
return $grants;
}
function mymodule_node_grants($account, $op){
$grants = array();
if (($op == 'view' || $op == 'update') && $account->uid == 99) { //(example conditions)
$grants['mymodule'] = array(
123,
);
}
return $grants;
}
This does add a line in node_access table where only grant_view has a value of 1. It should just allow related users to view the specific (unpublished) node but not edit it.
UPDATE: I installed Devel node access and here are my findings for the test case above (node 1234 is Unpublished, user 99 is author):
- Test User can View the node - OK
- Test User can Edit the unpublished node (non-Published draft) - NOT OK
- Test User cannot Delete the node - OK
- Test User can Moderate the Unpublished node (allowed transitions set by WM config.) - OK
Here is what Devel actually displays on that node's view page:
- Create: YES: by node (permissions) - OK
- View: YES: view own unpublished content - OK
- Update: YES: by node (permissions) - This should be overridden by my access module
- Delete: NO: no reason - OK
How can I override this edit permission with my module? I'd eventually like to expand the functionality of this module to cover other cases as well.