Management of priorities with node_access I do not understand how priorities are set for the node_grants... I have a module node_grants function that provides 4 grant ids for the user, but some nodes only have 2 gids... how do I know which one allows the user to view the node or not?

Thanks,
If you install the Devel module, there is a sub-module called Devel Node Access (DNA) that you can also enabled.

When you do this, two new blocks will become available.  One shows node access by users.  The other shows the access records for the node you are viewing (or the nodes that happen to be on that page), both hook_node_access() and grants.

Typically, I will install both blocks at he bottom of the Content region, as they can be big/wide, and only give their view permission to a few users.  If I am having grant weirdness, then I give the permission to all on a test site, and use user masquerading to see what is happening.

And as for priorities, this is described fairly well in the documentation on node access rights.  In short:


Deny by default
Check for bypass access permission
Call hook_node_access() per Drupal module ordering.  First denier wins, then first allower wins.
If there isn't a winner, hook_node_grants() is run per Drupal module ordering to build the list of grants.  Then tirst denier wins, then first allower wins.
Otherwise deny.


Try to read through node_access(), after the node access rights page, for the finer details.