Different permissions after node publishing

Question

I have a role (Creators) where users can create/edit/delete nodes of some content types but they can't publish it, publication is done by other role (Publishers), I'm using Workbench and Workbench Moderation modules.

Now I need to disable Creators role to edit/delete content (even their own) after someone from Publishers role published node, so if user from Creators role create node and user from Publishers role publish that node, than node creator from Creators node can't edit or delete it.

How can I achieve something like this?

Answer 1

I resolve this with small custom module. I checking user role as well because I need to apply this only on one role.

There is my code:

/**
 * Implements hook_node_access().
 */
function MODULE_node_access($node, $op, $account = NULL) {
    global $user;
  if (
    // The $node argument can be either a $node object or a machine name of
    // node's content type. It is called multiple times during a page load
    // so it is enough if you perform the check once you get the object.
      is_object($node) && array_key_exists(6, $user->roles) &&
      // Operation on which you want to act: "create", "delete", "update", "view".
      ($op == 'update' || $op == 'delete')
  ) {
    // Check if the node is published.
    if ($node->status == 1) {
      return NODE_ACCESS_DENY;
    }
  }
}

My role's ID is 6, so I used this part array_key_exists(6, $user->roles) because of that.