Why return AccessResult::allowed() ends up with "Access denied"?

Question

I'm having a strange behaviour while trying to use hook_node_access in Drupal 8 (Lightning to be more precise) and I can't figure out why is doing this. Let's suppose that I want to always allow people to edit a certain content type (I know I can setup role permissions to achieve this, but I'm just trying to understand why it's not working):

function mymodule_node_access($node, $op, $account) {
  $type = $node->bundle();
  if($type == 'service' && $op == 'update') {
      return AccessResult::allowed();
  }
}

I always get "access denied" while trying to edit a "service" node.

This is what I've tried to do in order to debug it:

• in reports > status reports there are no node access permissions in use;
• the current user does not have "bypass content access control" permission;
• hook_module_implements_alter doesn't return any other module using hook_node_access.

Is there anything I'm missing?

Answer 1

Although I've checked for other modules using hook_node_access, I forgot to check for hook_entity_access as well. It turned out that the "content moderation" module is denying access. Thanks @4k4 for making me revisit this!

Just for the record, if you need to see which other modules are using a certain hook, you can use something like this:

function mymodule_module_implements_alter(&$implementations, $hook) {
  if($hook == 'node_access') {
    //do whatever you need to do (e.g. use kint($implementations) to see what other modules are using this hook)
  }
}