Proposed node_access/hook_nodeapi change

For the past two years, Amherst College has been working on a module which provides a granular, hierarchical, menu system with Unix-like access controls. This is more fully described here: http://groups.drupal.org/node/10231

As mentioned on that page, we would like to share this code with the Drupal community. The level of interest we've received from other educational and corporate institutions, as well as from the Boston user group, seems to imply that it has the potential to be widely adopted.

However, there is one issue that concerns us. As currently implemented, a patch to the node_access() function is required. We have been following some other discussions about changes in the node access scheme for D7, but have yet to see any that would preclude the need for this patch. Here's why:

Because our content is created by thousands of users of vastly differing ability and position within the organizational structure of the college, our module uses a hierarchical access control system -- similar to what Unix uses for subdirectories. Access to a particular node depends on a user's permissions to its container and all of that container's parents.

It would, therefore, be extremely difficult, if not impossible, to represent this as a single SQL query to the node_access table. Even if it could be done, the storage requirements for all the possible permutations would be astronomically huge, given that we have 36,000 users, 16,000 groups, 58,000 containers, and 41,000 nodes on our site.

The current hook_access() is also not applicable to our situation, since a module's hook_access() only gets called when it is the module that defines the particular node type. Our module needs to be able to return a definitive yes/no decision about any node.

Instead, we are proposing a simple extension of hook_nodeapi(), which adds the mode 'access'. In this scheme, the $a3 parameter receives the access mode being requested and $a4 receives the user account. If any module returns a boolean value, that value is interpreted as the "end all and be all", and the node_access table is not considered:

--- node.module.orig	2008-06-18 09:43:11.000000000 -0400
+++ node.module	2008-06-18 10:41:25.000000000 -0400
@@ -2080,16 +2080,22 @@ function node_access($op, $node, $accoun
   $module = node_get_types('module', $node);
   if ($module == 'node') {
     $module = 'node_content'; // Avoid function name collisions.
   }
   $access = module_invoke($module, 'access', $op, $node, $account);
   if (!is_null($access)) {
     return $access;
   }
+  $access = node_invoke_nodeapi($node, 'access', $op, $account);
+  foreach ($access as $bool) {
+    if (is_bool($bool)) {
+      return $bool;
+    }
+  }
 
   // If the module did not override the access rights, use those set in the
   // node_access table.
   if ($op != 'create' && $node->nid && $node->status) {
     $grants = array();
     foreach (node_access_grants($op, $account) as $realm => $gids) {
       foreach ($gids as $gid) {
         $grants[] = "(gid = $gid AND realm = '$realm')";

While we would be interested in discussing the possibility of alternate schemes which improve upon the existing node_access system, we know that this would require a substantial amount of debate and code change.

On the other hand, the approach outlined above is an easy win. It involves minimal code change, and has no effect upon backward-compatibility. Since there is a good chance that other modules would also benefit from this change, I would like to propose that it be made to core in D7.