System architecture:

Main entities:

  • Company
  • Employee (and other user types)
  • Document


  • Every document has reference to company and employee.
  • Every employee has reference to company also (at least one company)

I've implemented custom access control for documents, which suppose to working fine (my unit tests gives me all green also).

Now I'm creating View - documents list for an employee. Basic version of View is working correct. I want to add exposed filter for a company. By default this is a list of all companies. But I want to restrict this list only for companies from employee documents, related to current logged in employee.


 * Implements hook_node_access_records().
function mymod_company_node_access_records($node) {
  if ($node->type <> myCompany::CONTENT_TYPE_NAME) {
    return array();

  return array(
      'realm' => MYMOD_COMPANY_LOCK_NAME,
      'gid' => $node->nid,
      'grant_view' => 1,
      'grant_update' => 0,
      'grant_delete' => 0,
      'priority' => 0,

 * Implements hook_node_grants().
function mymoo_company_node_grants($account, $op) {
  if ($op <> 'view') {
    return array();

  if (mymod_user_is_an_employee($account)) {

    $myUser = myUser::createFromUser($account);
    $companies = $sdUser->getCompanies();
    if (empty($companies)) {
      return array();

    $grants = array();

    foreach(array_keys($companies) as $nid) {
      $grants[MYMOD_COMPANY_LOCK_NAME][] = $nid;

    return $grants;

  } else {
    return array();

Indeed filter list is restricted to employee related companies, but in my View, I'm seeing ALL documents related to these companies. Why?

My View main content type is Document. Company is related node via entity reference field. I don't understand why company access control has some type of precedence here.

  • Just some guessing here, but could it be that returning an empty array in hook_node_access_records grants access to that node? Nov 30, 2015 at 8:23
  • It's probably not. I done it based on other examples which were similar. I think that access control look only for one realm to be opened for a user. If yes, doesn't care about other realms.
    – Codium
    Nov 30, 2015 at 9:10
  • See my answer, the return of an empty array in hook_node_access_records creates a view all record in the node_access table. Nov 30, 2015 at 9:59

1 Answer 1


While browsing through the Drupal docs about hook_node_access_records, I stumbled upon this comment:

Note that (as of 7.35) if your module and every other module in your installation implementing this hook return empty arrays, Drupal will automatically insert a record into the node_access table for the given node with GID 0, grant_view set to 1, and grand_update and grant_delete set to 0.

You can find it here (last comment).

  • I tried, but no success. Instead of grants I'm using hook_node_access. It work partly, because I'm seeing "Restricted Access" instead of node title on nodes for user, who has no access to them, funny :)
    – Codium
    Nov 30, 2015 at 19:25
  • Have you tried rebuilding the permissions and clearing the cache? Dec 1, 2015 at 19:06
  • Yes, - Restricted Access - is hardcoded in Entity Reference module. I've just removed these items from entity select list
    – Codium
    Dec 1, 2015 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.