In the Workflow module, How can I programmatically change permissions? In addition to roles I want to check against a proflie value to allow or not allow users see or edit a node in a specific workflow state.
There is no single hook that allows you to control who can see or edit a node in a specific workflow state. You might want to implement hook_node_access_records() to give out grants for a specific node and hook_node_grants() to check whether a specific user has that grant.
The result of your
hook_node_access_records() implementation is stored in the database and checked via your
hook_node_grants() implementation. Have a look at node_access() to see how the latter is done.
I cannot tell you off-hand what to use as realm and what to use as grant ID. The most important restrictions are:
- the grant ID is an integer,
hook_node_access_records()does not know which user tries to access the node,
hook_node_grants()does not know about the node that is being accessed.
In your case, it seems reasonable to put the expected profile value into the "realm" (along with the module name for disambiguation) of your
hook_node_access_records() implementation. Your implementation of
hook_node_grants() would then check whether the user has that profile value and return the appropriate realms. Still you need to accommodate for the workflow state somewhere.