TAC and OG

An excellent idea, and I believe it can now be done: Someone has posted a snippet that modifies the node module (node_access) to use an Extensible Node Access/Authorisation capability: http://drupal.org/node/122173.

This allows me to write a permission check in the nodeapi section of TAC that could first check OG before returning TRUE or FALSE for TAC. A similar check (in reverse) would be written in the nodeapi section of OG. This, effectively, would allow the two modules to work together!

So, now all I need is a simple permission check in TAC that does not use node_access.

My final question: Is there a function in TAC that does NOT use node_acess which I could use in order to simply return TRUE or FALSE if the current user has access to the current node ($node, $op)?

Thanks so much!

I actually managed to get a scenario working that respects OG and TAC permissions. If content is tagged as private to a group, and contains private taxonomy, it can only be accessed if the user is in the group and in a role which permits access to the taxonomy term.

With the snippet described here: http://drupal.org/node/122173, it was really kind of easy. The only function I needed to modify was taxonomy_access_nodeapi, and even then I simply added the 'access' case which is only used by the snippet. I wrote my own function to return TRUE or FALSE for access.

However, I still have a problem. My modifications are triggered from "node_access", so my permissions work for everything except node listing (views, tracker, recent posts, etc...).

So now, users can list content that they can't actually access. Sigh....

Everything I've read says to look at db_rewrite_sql(). node_access was a walk in the park compared to this. Can you point me in the right direction?

Again, thanks.

When node.module calls hook_node_access_records($node) of this module, it would recall hook_node_access_records($node) of OG and TAC, then it would calculete an aggregate permssion based on these. Finally it would return the array of the aggregate permissions with higher PRIORITY (than OG or TAC).
This would cause that these values w/ higher priority are saved to table node_access. (anulling OG and TAC values).

I've already got all permissions working except for list. It sounds like, from your idea, where I need to be looking is hook_node_access_records($node). If your idea about a 3rd module used to aggregate the permissions will work, then surely modifying the existing access_records function should as well (although I agree, this is not the best strategy for long term -- but until that 3rd module gets built, this will resolve my issue for now).

Do you agree?

If so, how would you suggest I modify the taxonomy_access_node_access($node) function to respect the OG permissions as well?

I actually got up to speed on db_rewrite_sql and modified the taxonomy_access_db_rewrite_sql like this:

      $sql = "SELECT t.tid, d.vid, BIT_OR(t.grant_$op) AS grant_$op FROM {term_node} tn
INNER JOIN{term_access} t ON t.tid=tn.tid
INNER JOIN {term_data} d ON t.tid=d.tid
INNER JOIN {og_ancestry} oa ON oa.nid=tn.nid
WHERE t.rid in ('".implode("','",$rids)."') 
AND grant_$op = 1 group by t.tid, d.vid
AND oa.group_nid in ('".implode("','",$gids)."')";
// $gids are group ids of current user - so, at the very least, I should only see grants for data in groups this user belongs to.

Did the same thing for og_access_db_rewrite_sql. I only have og and tac access controls.

I tested this sql independently and it does limit the access grants to just those I want. However, when the modules are modified and uploaded (delete cache, run cron.php), my default views still list all documents even though the user does not have access. It lists tac documents that should not be listed for the user according to the db_rewrite_sql logic (same for og).

Does this mean I need to modify node_db_rewrite_sql itself, or I'm still missing some piece of this puzzle? Or, should I be looking at hook_node_access_records?

This is the final piece. of the puzzle. Once I get this, I should be home free. Thanks!

Got it working modifying only node_db_rewrite_sql. OG and TAC are working in concert. All node listings work as expected.

However, my "categories" box doesn't appear on node submission forms for any user except the admin user. I have vocabularies set up with terms for node types that my authenticated users are allowed to access.

So, my guess is that somewhere something that's supposed to tell the node_add function to place the categories box is not working in either node or taxonomy_access modules somewhere. Any ideas where that would be in the TAC module?

Thanks!

Got it.

In the taxonomy module, taxonomy_form_alter($form_id, &$form) handles the creation of the Categories box which contains the vocabulary and terms.

What I discovered in that function is that it is this line:

    $c = db_query(db_rewrite_sql("SELECT v.* FROM {vocabulary} v INNER JOIN {vocabulary_node_types} n ON v.vid = n.vid WHERE n.type = '%s' ORDER BY v.weight, v.name", 'v', 'vid'), $node->type);

which gathers the vocabularies that this user has acces to. And, it is taxonomy_access_db_rewrite_sql() (at least in my case, since I have it installed) which rewrites the sql based upon the user and his role IDs.

So, I went back to taxonomy_access_db_rewrite and modified it to get the correct role IDs, and bingo, problem solved.

Now, to put this into a separate module.... Thanks for all your help.

I've had my TAC/OG integration working fine for a few months now. I'm ready to try and move the functionality into a separate module, as you have wisely suggested, rather than patch TAC.

The only place I needed to patch TAC was in the taxonomy_access_db_rewrite_sql() function. It has been suggested to me that if I take my modified hook_db_rewrite_sql() code, place it in a custom module and weight that module higher than the taxonomy_access module, that my modified code will effectively override the taxonomy_access_db_rewrite_sql() code, provided it executes under the same conditions, i.e.

  if (!user_access('administer taxonomy') && ($field =='vid' || $field =='tid')) {

.

Do you concur?

It has been suggested to me that if I take my modified hook_db_rewrite_sql() code, place it in a custom module and weight that module higher than the taxonomy_access module, that my modified code will effectively override the taxonomy_access_db_rewrite_sql() code, provided it executes under the same conditions,

FYI: Yes, it works.