Prevent a user from viewing another user's profile based on a field value

Question

I'm a Drupal veteran, but this one has me stumped . . .

I have two Profile2 profiles, one for a company and one for a job seeker. In the job seeker profile, there is an entity reference field where they add companies they don't want to view their profile. The way companies finds people is by searching via Search API. Another way, would be by browsing. I need to block both ways. Basically, the job seeker should be invisible to the companies that they've blocked.

I have Panels, Panelizer, Rules, and Views all at my disposal and know how to use them, just not in this case. Or am I better going with my own custom module?

I saw this answer Hide Profile2 fields depending on it's value when viewing user profile and that's only for specific fields, I want to block the whole profile.

This question is along the same lines of mine, but I don't see a complete answer -How to filter a view based for the current user based the value of custom fields in his profile and fields in the list of items viewed

Answer 1

You can control profile2 access with

hook_profile2_access

Views listens to node access so you might be able to use to exclude rows from the view.

/**
 * Implements hook_profile2_access
 */
function MY_MODULE_profile2_access($op, $profile = NULL, $account = NULL) {
  if (isset($profile)) {
    // Use wrapper for field access
    $profile_wrapper = entity_metadata_wrapper('profile2', $profile);
    // Check if $account uid is set in field_invalid_users
    if(isset($profile_wrapper->field_invalid_users)){
      if(in_array($account->uid, $profile_wrapper->field_invalid_users->raw())){
        // Deny access
        return FALSE;
      }
    }
    // Example: Explicitly deny access for a 'secret' profile type.
    if ($profile->type == 'secret' && !user_access('custom permission')) {
      return FALSE;
    }
    // In other cases do not alter access.
  }
}

One consideration is caching. Cache will need to vary enough to not serve the same cached content to valid and invalid users. Perhaps those pages aren't cached at all, it depends on your application.

Answer 2

You can add an 'access callback' function to the menu hook for the pages you want to block and inside that function perform your own checks against the currently logged in user. This also means you must block the page for anonymous users or the company can just logout and view the profile anyway.

For hiding in search results I see two options:

Easy solution

In search-result.tpl.php or hook_preprocess_search_results you check access and don't show it. Drawback is that the count of the total results wouldn't be correct anymore.

More advanced

Add an extra indexed field blockedcompanies which contains all ids of the blocked companies in Solr with hook_apachesolr_index_document_build. When searching: add a check on this field with hook_apachesolr_query_prepare.