I am trying to customize an existing module (casetracker) with a new content type that would be visible only to the creator (if not anonymous) and anybody with a "support person" role. This is on a site where TAC is enabled and hides uncategorized content (which those new nodes would be, since the type doesn't have a taxonomy associated to it) from everybody except content administrators.
I started from the existing casetracker_basic_case type and set the hook_access function to do the following (my support people will have the 'access case tracker' access right):
case 'view':
if (0 < (int)$user->uid
&& ((int)$node->assign_to === (int)$user->uid
|| (int)$node->uid === (int)$user->uid)
) {
return true;
} else if (user_access('access case tracker')) {
return true;
}
break;
My nodes display correctly (ie. are visible) for whoever created them and for the support roles. They are not shown to other users and to anonymous. So far so good.
Unfortunately they do not show up in node lists, including the casetracker custom views. Those remain completely empty for everybody except the content administrators (with access to uncategorized nodes).
Looking at the queries used to grab node lists by casetracker, my problems stems from the correct use of db_rewrite_sql by that module and the opposite of what the API doc warns against and was discussed on several other node access threads.
Basically since I use TAC the default "view allowed to all" row in the node_access table (which hook_) is not in my DB, denying access to all without access granted through taxonomy. And when db_rewrite_sql is properly called on the query collecting cases to show, it excludes nodes the access hook function would have granted access to.
Is there a way to make this work with hook_access (and... what? hook_db_rewrite_sql??) or should I bite the bullet, let hook_access fall through for my new content type, and do a full hook_node_grants/hook_access_records implementation (along the lines of node_access_example.module which does most of what I want)?
Any hints on which approach is "best" (and how do we define "best")?
