Handle the 'view own unpublished content' perm when displaying referenced nodes

I thought addTag('node_access') eliminates the need to call node_access on each node returned from the query.
Unpublished nodes do not show up when using the preview patches.

Fixed patch, bad EOF.

@jide node_access() calls are redundant. Calling addTag('node_access') on a query builder handles this for you. Grep the core source for addTag(.*) or addTag('node_access'), you'll see what I'm referring to. FYI, there is talk of expanding it to the entity access also (#777578: Add an entity query access API and deprecate hook_query_ENTITY_TYPE_access_alter()). If fact, now that I think about it, some of my code may be redundant also. Will need to do more testing.

@h0tw1r3 is right, we won't be calling node_access() on every displayed node, that is what the 'node_access' query tag does for node listings.

Patch #7 makes sense, other places in core use the same construct to handle the 'view own unpublished content' permission (which IIRC, was introduced in D7, and which we missed in the D7 port of noderef)

Fixed code style and moved the query to a static query, though.

Committed the attached patch.

Please note that this causes a SQL fatal error due to undefined variable: #1236096: Undefined variable own_published in node_reference_field_prepare_view() causes SQL fatal.

Link to documentation on addTags() if it helps anybody landing here - http://drupal.org/node/310077

seems the issue still existing in the dev release "references-7.x-2.x-dev", which was released on 2011-Oct-10.

Here is the link to the details of the test result: http://drupal.org/node/1315048

change the status to active due to the failed test

Correct me if I am wrong but when a node is created unpublished, it has no entry in the node_access table. Which means that altering query with addTag('node_access') and calling node_access() will NOT return the same results (I have experienced that). In addition to that there may be node_access hook logic implemented by other modules that is ignored by the query alteration.

And it is not only about viewing the referred unpublished nodes: when I edit an unpublished node, I would like to be able to refer to other unpublished ones, so I need autocomplete, and correct potential references listing. Currently I can't link unpublished contents through node_references due to addTag('node_access') filter.

Here is a patch that fixes what is mentioned in #17. It gets back to node_access() calls...

I think @loveland issues in #14 have been solved since then. From my own tests, it works correctly.

@yop:

when a node is created unpublished, it has no entry in the node_access table. Which means that altering query with addTag('node_access') and calling node_access() will NOT return the same results

That's correct. But in node_reference_field_prepare_view(), the intent of the 'node_access' query tag is not to filter out unpubished nodes. The filtering of unpublished nodes is done through specific additions to the query around the node.status field.

There may be node_access hook logic implemented by other modules that is ignored by the query alteration.

Yes (actually hook_node_access in D7). The doc for the hook mentions that "this function isn't called for node listings (e.g., RSS feeds, the default home page at path 'node', a recent content block, etc.)". We're consistent with that, the values of a node_ref field are a 'node listing'.

Calling node_access() on each references nodes individually would be an important performance hit on listing pages with 10s of nodes (and potentially 100s of referenced nodes).

Node listings in drupal are dealt with by the 'node_access' tag + query logic around the 'status' field. That's not the role of node_access().

when I edit an unpublished node, I would like to be able to refer to other unpublished ones, so I need autocomplete, and correct potential references listing. Currently I can't link unpublished contents through node_references due to addTag('node_access') filter.

I don't understand the issue. As you pointed, the 'node_access' query tag doesn't filter out unpublished nodes, so yes, node ref widgets do let you select unpublished nodes.

All in all, I'd think this issue can be closed. Marking 'needs more info' for @yop's last point.

Ok, my fault: view_unpublished was not properly configured. #14 fixes all. My last point in #17 is not relevant any more.

Ok, thks for reporting back.
Closing the issue, then.