Views Search Ignoring Custom Node Access permissions

Question

I have a hook_node_access function that denies users view access to a page node if the node has a certain tag and they are not an authenticated user.

This is working fine for viewing the page directly but unregistered users can still see the nodes that they should be denied in a views powered search page. When they click through to the page they are denied access.

I was using the taxonomy access control module to do this before and that hid the result from search, I had to disable it because of a conflict with another module.

Is there anything extra I need to do to make views recognise these permissions?

Here's my hook and helper function:

function mymod_page_perms_node_access($node, $op, $account){ 
  if ($op === 'view' && in_array($node->type, array('page','publication'))){
    $access_level = field_get_items('node', $node, 'field_access_level');
    if (count($access_level)){
      $access_level = $access_level[0]['tid'];

      $accessIDtoRoleID = array(
        '68' => '7',
        '69' => '2');
      if (isset($accessIDtoRoleID[$access_level])){

        global $user;
        $requiredRole = $accessIDtoRoleID[$access_level];
        if (mymod_page_perms_check_allowed_roles_array(array($requiredRole),$user->roles)){
          return NODE_ACCESS_ALLOW;
        } else {
          return NODE_ACCESS_DENY;
        }
      }
    }
  }

  return  NODE_ACCESS_IGNORE;
}

function mymod_page_perms_check_allowed_roles_array($allowedRolesIds,$roles){
  foreach ($roles as $rid => $role){
    if (in_array($rid, $allowedRolesIds)){
      return true;
    }
  }
  return false;
}

thanks

Answer 1

It seems that a better way to control node access is through hook_node_access_records and hook_node_grants as described in the Drupal documentation writing a module that handles node access . This works with views properly.

I wrote this simple module based on the instructions in the link above:

define('MYMOD_REALM', 'mymod');
define('MYMOD_GRANT_ID_PUBLIC', 0);
define('MYMOD_GRANT_ID_MEMBER', 1);
define('MYMOD_GRANT_ID_BOARD', 2);
define('MYMOD_BOARD_MEMBER_RID', 7);
define('MYMOD_MEMBER_TID', 69);
define('MYMOD_BOARD_MEMBER_TID', 68);

/**
  * Implementation of hook_node_grants().
  */
function mymod_node_grants($account, $op) {

  if ($op == 'view') {
    $grants[MYMOD_REALM] = array( MYMOD_GRANT_ID_PUBLIC );
    if (array_key_exists(DRUPAL_AUTHENTICATED_RID, $account->roles)) {
      $grants[MYMOD_REALM][] = array( MYMOD_GRANT_ID_MEMBER );
    } 
    if (array_key_exists(MYMOD_BOARD_MEMBER_RID, $account->roles)) {
      $grants[MYMOD_REALM][] = array( MYMOD_GRANT_ID_BOARD );
    } 
    return $grants;
  }
}

/**
 * Implementation of hook_node_access_records().
 */
function mymod_node_access_records($node) {

  $grant = array(
      'realm' => MYMOD_REALM,
      'gid' => MYMOD_GRANT_ID_PUBLIC,
      'grant_view' => 1,
      'grant_update' => 0,
      'grant_delete' => 0,
      'priority' => 0,
    );
  if (in_array($node->type, array('page','publication'))){
    $access_level = field_get_items('node', $node, 'field_access_level');
    if (count($access_level)){
      $access_level = (int)$access_level[0]['tid'];
    
      switch ($access_level) {
        case MYMOD_BOARD_MEMBER_TID:
          $grant['gid'] = MYMOD_GRANT_ID_BOARD;
          break;
        case MYMOD_MEMBER_TID:
          $grant['gid'] = MYMOD_GRANT_ID_MEMBER;
          break;
      }
    }
  }
  $grants[] = $grant;

  return $grants;
}