Node edit layout based on Role

Question

I want Authenticated users to be able to add content (a custom content type). However, they should not see all the fields.

Users with a Role of "manager", should be able add/edit this content type, and see all the fields.

I've created a custom module, using hook_theme and hook_form_alter to hide the display of fields, but i don't know how to do this based on user or role. With the module active, even the admin user is blocked from seeing all the fields.

What is the best way to setup a custom node edit form based on Role, or at minumum, bypass for the Admin user?

For example, I have hide the form fields in erp_reco--node-form.tpl.php, and hide the revision, author, comments etc in hook_form_alter.

How do i hide fields then based on Role?

 function cct_erp_reco_theme($existing, $type, $theme, $path) {
return array(
    'erp_reco_node_form' => array(
        'arguments' => array('form' => null),
        'path' => drupal_get_path('theme', 'ERP').'/templates/forms',
        'template' => 'erp_reco--node-form', 'render element' => 'form',
    ),
); }

function cct_erp_reco_form_alter(&$form, &$form_state, $form_id) {
if($form_id == 'erp_reco_node_form') {
$form['revision_information']['#access'] = false;
$form['options']['#access'] = false;
$form['path']['#access'] = false;
$form['comment_settings']['#access'] = false;
$form['author']['#access'] = false;
$form['path']['#access'] = false;
$form['menu']['#access'] = false;
}
}

Answer 1

as @Human love mentioned there is a module out there to accomplish this Field Permissions. There is usually a module to do just about anything in Drupal -- but therein lies the problem; 80+ modules later you may regret installing so many modules.

There are plenty of examples of leveraging Drupal Core and not just using 3rd party contrib modules to meet your needs to keep a lean(er) codebase. Here's an example with EFQ from Phase2 in place of using Views.

That being said you just need to check for a UID or Role in your hook_form_alter. See the next 2 examples:

function cct_erp_reco_form_alter(&$form, &$form_state, $form_id) {
  global $user;
// Allow admin.
if($form_id == 'erp_reco_node_form' && $user->uid !== 1) {
$form['revision_information']['#access'] = false;
$form['options']['#access'] = false;
$form['path']['#access'] = false;
$form['comment_settings']['#access'] = false;
$form['author']['#access'] = false;
$form['path']['#access'] = false;
$form['menu']['#access'] = false;
}
}

Or:

function cct_erp_reco_form_alter(&$form, &$form_state, $form_id) {
  global $user;
// Dont show items for SOME_USER_ROLE.
if($form_id == 'erp_reco_node_form' && in_array('SOME_USER_ROLE', $user->roles)) {
$form['revision_information']['#access'] = false;
$form['options']['#access'] = false;
$form['path']['#access'] = false;
$form['comment_settings']['#access'] = false;
$form['author']['#access'] = false;
$form['path']['#access'] = false;
$form['menu']['#access'] = false;
}
}

Ideally the contrib module will be more flexible in the long run for many many content types etc. But, if you understand your own requirements then this is perfectly fine.