I'm trying to write a custom node access module, implementing hook_node_access.
I have a searchapi index of all my nodes, which I would like to return results that obey the hook_node_access conditions (at the time of indexing, at least) without requiring additional postprocessing.
In order to do this, I am enabling the 'Node access' filter on the search index ('Add node access information to the index.') I'm using search_api_solr, search_api_views, and the 'retrieve result data from solr' option. The indexes have been rebuilt.
However, when I look at the results of a search performed as an anonymous user, I find that nodes for which my node_access returns NODE_ACCESS_DENY are being included. In other words, it seems to be ignoring my node_access function.
Further investigation reveals that the SearchApiAlterNodeAccess class is adding Grant information to the index. I don't really understand the Grants system, but I guess it's an alternative way of controlling individual node access. I don't have any custom node_grants, so as a result, each node which fails node_access is given the default realm:all, gid:0 grant. And then the _search_api_query_add_node_access function adds an or-condition for any nodes with appropriate grants, which for anonymous users turns out to be realm:all, gid:0.
In other words, within the searchapi system, it looks like node_access is bypassed by node_grants. Even though within node_access itself, node_grants are only considered if hook_node_access has been inconclusive.
(For reference, my node_access table contains a single row: nid=0, gid=0, realm=all, grant_view=1.)
I'm sure I'm missing some vital logic here. Any suggestions?