<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<p>Many thanks to everyone who responded to my problem. After about the
3rd or 4th email mentioning the special case for user #1, I finally
realized what I needed to do. I also wish to respond to some of the
issues brought up as a result of this discussion.</p>
<p><b>The solution</b></p>
<p>I made the following modification to the first line, and it worked:</p>
<p> if ($primary_field == 'nid' &&
!node_access_view_all_nodes() && !user_access('administer
nodes')) {<br>
</p>
<p><b>Overriding node_db_rewrite_sql()</b></p>
<pre>David Cohen wrote:</pre>
<blockquote>i'll go further, and suggest that you should not implement
that hook in <br>
your module either. you want to restrict nodes using the node access <br>
API, just like og itself. See the example node_access module on <br>
api.drupal.org</blockquote>
<p>I'm sure you're right. </p>
This particular issue is part of a larger effort I've embarked on to
make different access control systems work together. See:
<a class="moz-txt-link-freetext" href="http://groups.drupal.org/access-control">http://groups.drupal.org/access-control</a>.
<p>Yes, OG uses the node
access API for OG permissions, but what I am trying to do is make OG
work with TAC and Content Access. Actually, I have done this.
<a class="moz-txt-link-freetext" href="http://groups.drupal.org/node/3700">http://groups.drupal.org/node/3700</a> But, right now, I have to patch core
and contributed modules. This effort here is about moving the
functionality of that patched code into a separate module altogether.</p>
<p>So,
in order to not have to patch core code, I have to override the default
hook_db_rewrite_sql() functions from a separate custom module. </p>
<p><b>Why not use node access API, just like og itself?</b></p>
<p>I am very familiar with the node access API from my work on OG User
Roles: <a class="moz-txt-link-freetext" href="http://drupal.org/node/87679">http://drupal.org/node/87679</a></p>
<p>The
way the default system appears to work is to determine whether Module A
or Module B or Module C says a user can have access to a node. In
order to make OG User Roles, OG, TAC and CA work together, I need to be
able to say: Allow the user access if Module A AND (Module B OR Module
C ) says it's ok. If someone knows how to accomplish this with node
grants, and is willing to work with me, I am all ears.</p>
<p>The way I
figured out how to do it was by using the "Extensible Node
Access/Authoriisation Capability" patch:
<a class="moz-txt-link-freetext" href="http://drupal.org/node/122173">http://drupal.org/node/122173</a>. This same mechanism is discussed here:
<a class="moz-txt-link-freetext" href="http://drupal.org/node/143075">http://drupal.org/node/143075</a>. Many of us hope it finds its way into
Drupal 6. Anyway, this patch helps me refine node access to my exact
specifications. And, it works.</p>
<p>However, as you know, node_access
only handles create/view/update/delete requests and NOT list requests.
In order for node listing to match node access in my environment, I
needed to modify the node_db_rewrite_sql() function (as well as the
hook_db_rewrite_sql() functions in OG and TAC).</p>
<p>I did that, and I've had this wonderful cooperative environment
working for a few months now. </p>
<b>Using user #1 for development testing</b>
<p>Honestly,
I think the only reason I do this is because it's what I'm used to. I
can see and do everything I need to quickly and easily. Besides, if I
wasn't in this habit, I probably wouldn't have noticed the problem with
my hook_db_rewrite_sql() code, at least not right away.<br>
</p>
<p>-ron<br>
</p>
<pre class="moz-signature" cols="72">--
Ron Parker
Software Creations <a class="moz-txt-link-freetext" href="http://www.scbbs.com">http://www.scbbs.com</a>
Self-Administration Web Site <a class="moz-txt-link-freetext" href="http://saw.scbbs.com">http://saw.scbbs.com</a>
SDSS Subscription Mgmt Service <a class="moz-txt-link-freetext" href="http://sdss.scbbs.com">http://sdss.scbbs.com</a>
Central Ave Dance Ensemble <a class="moz-txt-link-freetext" href="http://www.centralavedance.com">http://www.centralavedance.com</a>
R & B Salsa <a class="moz-txt-link-freetext" href="http://www.randbsalsa.com">http://www.randbsalsa.com</a>
</pre>
</body>
</html>