I'm trying to write a custom node access module, implementing hook_node_access.

I have a searchapi index of all my nodes, which I would like to return results that obey the hook_node_access conditions (at the time of indexing, at least) without requiring additional postprocessing.

In order to do this, I am enabling the 'Node access' filter on the search index ('Add node access information to the index.') I'm using search_api_solr, search_api_views, and the 'retrieve result data from solr' option. The indexes have been rebuilt.

However, when I look at the results of a search performed as an anonymous user, I find that nodes for which my node_access returns NODE_ACCESS_DENY are being included. In other words, it seems to be ignoring my node_access function.

Further investigation reveals that the SearchApiAlterNodeAccess class is adding Grant information to the index. I don't really understand the Grants system, but I guess it's an alternative way of controlling individual node access. I don't have any custom node_grants, so as a result, each node which fails node_access is given the default realm:all, gid:0 grant. And then the _search_api_query_add_node_access function adds an or-condition for any nodes with appropriate grants, which for anonymous users turns out to be realm:all, gid:0.

In other words, within the searchapi system, it looks like node_access is bypassed by node_grants. Even though within node_access itself, node_grants are only considered if hook_node_access has been inconclusive.

(For reference, my node_access table contains a single row: nid=0, gid=0, realm=all, grant_view=1.)

I'm sure I'm missing some vital logic here. Any suggestions?

  • I am pretty sure this setting already exists in Search API. It should respect published and access setting.
    – Kevin
    Jul 18, 2017 at 19:26

1 Answer 1


Answering my own question: the solution seems to be to modify the search to explicitly add a condition for the grant that I'm interested in.

In this case, it means modifying the view to add a filter criteria: Node access information = node_access__all

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.