What determines who can view an unpublished node? The Node Access documentation explains that there are three things that affect node permissions, used in this order of preference until an answer is received: an overriding bypass node access permission; hook_node_access (used on single nodes and not in listings); hook_node_grants (which compares against the node_access table).

What I can't see is how (un)published content is handled. The only default implementation of hook_node_access is node_node_access which you can see completely ignores the 'view' mode, answering only for create/delete/edit modes.

The hook_node_grants docs say explicitly that (un)published content is "not handled by the system".

But there are the checkboxes in the user permissions table for view published content and view own unpublished content etc. Where are these implemented?
It is handled by node_access:


it checks for the "view published content" - without this permission every operation is denied, published or not.
it checks the view own unpublished content permission.
it checks if hook_node_access gives either deny/allow. If not...
If no module implements hook_node_grants then there's a default allow for published nodes (and therefore a deny if not).
If modules do implement hook_node_grants then the node_access table is consulted. I found that published content receives a "default grant" in the node_access table thanks to node_access_acquire_grants, meaning anyone can view it. Unpublished content has no default grant so is therefore denied.