Since you are setting 'access callback' to TRUE, you are actually giving access to those routes to every user, including the anonymous users.
You could easily set the access callback to a function in your module 'access callback' => 'ibbr_inv_access_callback' and check the roles the global $user variable has, but that would be a bad idea, since every time you need to give access to those routes to a new role, you would need to change the code of your access callback. Plus, since you are hard-coding the roles in your code, the module could not easily be adapted to different needs, such as sites using totally different roles.
The Drupal way is to assign permissions to the roles that should be able to access the routes you define, and use user_permission() as access callback for your routes. In this way, the code would check for the same permission, which could be given to new roles, or to totally different roles; any change in the roles having that permission would not reflect on your code, which would still work in any case.
As permission, you could use one that Drupal already use, or (if that is not restrictive enough) define a new permission.
function ibbr_inv_menu() {
$items['inventory_scan'] = array(
'title' => 'Inventory items',
'page callback' => 'ibbr_inv_menu_page_callback',
'access arguments' => array('administer inventory items'),
'type'=> MENU_CALLBACK,
);
$items['inventory_scan/add_item'] = array(
'title' => 'Add new item',
'page callback' => 'ibbr_inv_add_new_item_callback',
'access arguments' => array('administer inventory items'),
'type'=> MENU_CALLBACK,
);
return $items;
}
function ibbr_inv_permission() {
$permissions['administer inventory items'] = array(
'title' => t('Administer inventory items'),
'description' => t('Creates/deletes inventory items.'),
);
return $permissions;
}
To use a access callback that checks the roles the currently logged-in user has, I would use the following code. It's not the code I would use, but if you need to use such code for any reason, this is what I would suggest.
function ibbr_inv_menu() {
$items['inventory_scan'] = array(
'title' => 'Inventory Items',
'page callback' => 'ibbr_inv_menu_page_callback',
'access callback' => 'ibbr_inv_access_callback',
'access arguments' => array('the role the user needs to have'),
'type'=> MENU_CALLBACK,
);
$items['inventory_scan/add_item'] = array(
'title' => 'Add new item',
'page callback' => 'ibbr_inv_add_new_item_callback',
'access callback' => 'ibbr_inv_access_callback',
'access arguments' => array('the role the user needs to have'),
'type'=> MENU_CALLBACK,
);
return $items;
}
function ibbr_inv_access_callback($role_name) {
if ($role = user_role_load_by_name($role_name)) {
return user_has_role($role->rid);
}
// The role doesn't exists; return FALSE as safe value.
return FALSE;
}
The code works on Drupal 7.36 and higher, since it is using a function that previous versions didn't implement (user_has_role()).
As side note, since for inventory_scan/add_item you are using array(1, 2) as page arguments, the page callback would receive 'add_item' as argument, which doesn't make much sense; it would make sense if you were using the same page callback for different routes, and you would use 'add_item' to make the page callback know which action to perform.
In the same way, it doesn't make much sense to use array(1, 2) as page arguments for a route like inventory_scan; if you are not visiting inventory_scan/first_value/second_value, the page callback will not receive any arguments at all.
