Restricting node access for nodes that are associated with other nodes which have user reference

Question

I have one content type Jobs. These include a user reference field which is the contact.

I have another content type called Job Applications. The include a node reference field that links to Jobs.

How can I make so that public if someone attempts to read a URL for a job application, they won't be able to access that node unless they are contained in the user reference in the job node associated with that job application node.

I know that nodeaccess modules offers restrictions for content types containing user reference. I could add a contact user reference field in the job application content type BUT how do I keep it hidden (I think there is a module for hidding fields) AND more importantly how do I automate things so that when a job is selected (or used through node reference auto url) the hidden contact user reference field will automatically adjust based on that job node's user reference field.

Note: I don't want to restrict access by roles.

Update:

Job Contact (user reference)

Job Applications Job (node reference) Contact (user reference) <-------- I need this to be copied automatically from the job (that is referenced in the node reference) contact user reference

Answer 1

To add on, you can also consider the Access by Term module:

Provides very flexible, hierarchical node access control (content access control), for D7.

Supports following flags: View, Update, Delete

Grants are based on the relationship between the user->term<-node.

Answer 2

I don't have enough rep to comment, however, if you are referring to an authenticated user (logged in). You can set the Access Control rules for the logged in user per node. If the user is not logged in, then it is not possible as anybody with a valid URL can view the node.

If you want to hide fields in a content type node. Go to Structure->Pages->View Node (you will have to enable this first in case it isn't). Then create a new variant for that content type and then manually add fields you want the authenticated/anonymous user to see. Make sure you have Context and Selection rules enabled and that admin roles are excepted from viewing that variant. In other words, admin will see everything.