Drupal Book Permissions: Only Let Users Add Content to their Own Books

Today's project required me to fine tune Drupal's standard book module. Basically, I needed to limit the choices in the 'Book Outline' area to only display books that the user was the author of. Unfortunately, Drupal's default permissions don't allow for this. Either the user can administer all outlines or none, nothing in between.

Form Alter to the Rescue

So I created a custom module with a hook_form_alter() function and started inspecting the $form variable. The book outline form options are keyed with the node id, which I can use to check the author. If the user is the author, we keep the options in the list, otherwise we unset them.

The Full Code

function CUSTOMMODULE_form_alter(&$form, &$form_state, $form_id){
  switch($form_id){
    case 'course_node_form':
    case 'course_materials_node_form':
      // If the user doesn't have adminster content permission, limit the book list to their own nodes.      
      if(!user_access('administer content')) {
        _HELPER_limit_book_list($form, TRUE);
      }
    break;
    
  }
}

function _HELPER_limit_book_list(&$form, $remove_new = FALSE) {
  global $user;
  $author_nids = array();
  // Get an array of node id's from the options.
  $book_nids = array_keys($form['book']['bid']['#options']);
  // Query the database and get the authors nodes.
  // Wanted to avoid the overhead of node_load. Especially since this list could grow decently large.
  db_query("SELECT nid, uid FROM {node} WHERE nid in (:nids)", array(':nids' => $book_nids));
  $results = db_query("SELECT nid, uid FROM {node} WHERE nid in (:nids) and uid = :uid", array(':nids' => $book_nids, ':uid' => $user->uid));
  foreach($results as $row) {
    $author_nids[$row->nid] = $row->nid;
  }
        
  foreach($form['book']['bid']['#options'] as $key => $value) {
    // If the $key (the nid in this case) is not in the $author_nid array, unset it from the options list.
    if (!$remove_new && $key == 'new') {
      continue;
    }
    // If the logged in user is not the author, remove the option from view.
    if (!isset($author_nids[$key])) {
      unset($form['book']['bid']['#options'][$key]);
    }
  }
}