/**
  * Checks the node grants for the given operation.
  *
  * @param string $operation
  *   The operation to check the node grants for.
  *
  * @return string
  *   The string representation of the cache context.
  */
 protected function checkNodeGrants($operation)
 {
     // When checking the grants for the 'view' operation and the current user
     // has a global view grant (i.e. a view grant for node ID 0) — note that
     // this is automatically the case if no node access modules exist (no
     // hook_node_grants() implementations) then we don't need to determine the
     // exact node view grants for the current user.
     if ($operation === 'view' && node_access_view_all_nodes($this->user)) {
         return 'view.all';
     }
     $grants = node_access_grants($operation, $this->user);
     $grants_context_parts = [];
     foreach ($grants as $realm => $gids) {
         $grants_context_parts[] = $realm . ':' . implode(',', $gids);
     }
     return $operation . '.' . implode(';', $grants_context_parts);
 }

/**
 * Perform alterations to a structured query for a given tag.
 *
 * @param $query
 *   An Query object describing the composite parts of a SQL query.
 *
 * @see hook_query_alter()
 * @see node_query_node_access_alter()
 * @see QueryAlterableInterface
 * @see SelectQueryInterface
 */
function hook_query_TAG_alter(QueryAlterableInterface $query)
{
    // Skip the extra expensive alterations if site has no node access control modules.
    if (!node_access_view_all_nodes()) {
        // Prevent duplicates records.
        $query->distinct();
        // The recognized operations are 'view', 'update', 'delete'.
        if (!($op = $query->getMetaData('op'))) {
            $op = 'view';
        }
        // Skip the extra joins and conditions for node admins.
        if (!user_access('bypass node access')) {
            // The node_access table has the access grants for any given node.
            $access_alias = $query->join('node_access', 'na', '%alias.nid = n.nid');
            $or = db_or();
            // If any grant exists for the specified user, then user has access to the node for the specified operation.
            foreach (node_access_grants($op, $query->getMetaData('account')) as $realm => $gids) {
                foreach ($gids as $gid) {
                    $or->condition(db_and()->condition($access_alias . '.gid', $gid)->condition($access_alias . '.realm', $realm));
                }
            }
            if (count($or->conditions())) {
                $query->condition($or);
            }
            $query->condition($access_alias . 'grant_' . $op, 1, '>=');
        }
    }
}