How to make a MENU_LOCAL_TASK on a user's profile only appear on their profile?

Question

I use logic like this to place a tab on each user's profile page so users can view analytics from the usage of a WebApp:

  // maps a url to a sub-page of user's profile, url to user's Analytics-Management form
  $items['user/%user/ClientCompanyName'] = array(
    'title'            => 'ClientCompanyName',
    'description'      => 'Manage your ClientCompanyName services.',
    'page callback'    => 'drupal_get_form',
    'page arguments'   => array('_ClientCompanyName_mgmt_form'),
    'access callback'  => 'user_access',
    'access arguments' => array( 'access ClientCompanyName services' ), 
    'type' => MENU_LOCAL_TASK,
  );

This works great for each user, but I do not want one user to be able to go to another user's profile and hit their link to get to that other user's private analytics data.

Currently, if a user tries to visit another user's analytics management page, they see an access denied page.

But I would like them never to even be given the link to that page. I tried writing my own 'access callback', but I can't figure out how to pass in the '%user' portion of the intended url so I can test that against the logged in user...

I like how one can use '%' symbols in the url, and then 'page arguments' can be used to reference those arguments in the url. Is it possible to do something similar with the 'access arguments'?

Essentially, I'm trying to achieve the same thing as the behavior of the 'edit' tab on a user's profile: only if the user is on their own profile page will that 'edit' tab appear on the profile. How do I get the same effect for my WebApp analytics page?

(I guess I could make my analytics page a MENU_LOCAL_TASK of the profile edit form... but I'd still like to know how to create a conditional MENU_LOCAL_TASK whose conditional is more then simply an user_access() permissions test.)

Answer 1

Instead of user_access, define your own access callback function and then pass the user object to that.

So 'access callback' => 'yourmodule_analytics_access' and 'access arguments' => array(1).

In that function, compare the user id and check the permission.

function yourmodule_analytics_access($account) {
  global $user;
  return $user->uid == $account->uid && user_access('access ClientCompanyName services');
} 

Answer 2

I ended up using a custom access callback like this:

// this makes the analytics user profile tab's MENU_LOCAL_TAB conditional:
function _cex_mgmt_access($accessAllowed) {
  global $user;
  if (arg(1) != $user->uid)
    return false;
  return user_access($accessAllowed);
}

Where the 'access callback' parameter in the MENU_LOCAL_TASK definition is set to '_cex_mgmt_access' rather than 'user_access'.

I'm a bit uncertain about this method. It depends upon the menu module's logic that handles the MENU_LOCAL_TASK definition to be processed each time a user travels to any profile page. Doesn't that information get cached (if caching is turned on)?