Views - Protect user-assigned content from direct url access

Question

I'd like to create a restricted area from scratch using views.

What I'd like to achieve:

• The admin creates a photo album and assigns it to a photographer
• A photographer is able to log into the site, and see a list of albums that are assigned to them
• The photographer can upload photos to the album
• If a non logged user tries to access the album by typing its url, they get rejected
• Ideally, photos (the files themselves) that are in an album are also protected, I know that file access restriction is a complex subject, but I'm okay with a sort of proxy-page that would then redirect to the file with an unguessable url, or a solution of this type.

Where I am so far:

• Create a user role Photographer
• Create a content type album with fields:
  • Photographer (user reference, role=photographer)
  • Photos (file, number of values unlimited)
• Create a view to list content type=album, with a contextual filter on the Photographer field that defaults to current user id when not provided in the url. So that a logged photographer only sees their own albums. That works fine.

My problem:

• Anyone can enter an album's url and access it directly [solved]
• Anyone can enter a photo's url and download it [solved]

I've built this on drupal 8 but can also use drupal 7 and other modules. Any help would be very much appreciated!

---

Update:

I think I found part of the answer. Using private directory with the files module: https://www.drupal.org/documentation/modules/file. According to the docs:

For example: you have created a new content type with a file field which stores files in your site's private file directory. Next you create a node from this new content type and attach two new files. When the node is published links to both attached files are visible and anyone who can view the node may download the files. Now, if you unpublish the node, all attached files become inaccessible for download even if you use the direct link to the files that worked when the node was published.

Answer 1

Have a look at the Group module which allows for creating arbitrary collections of your content and users on your site, and grant access control permissions on those collections. It is available as of D7, and has a D8 version also.

The Group module creates groups as entities, making them fully fieldable, extensible and exportable. Which also makes it integrate very well (out of the box) with commonly used modules such as Rules, Views, etc.

For more details about the various roles and permissions, refer to my answer to "What are the various roles supported by the Group module?".

Resources

• Community documentation for the Group module.
• Video tutorial "How to use the Group module in Drupal 8 to manage editorial access control to different areas of a web site".

Answer 2

So I ended up using Drupal ACL Module which allows to grant access to a node to a group or user. This way, if one tries to access the node by entering its url, they get rejected: https://www.drupal.org/project/acl

I also made use of Drupal protected node to allow node access via password without being logged: https://www.drupal.org/project/protected_node

And I implemented a few Rules with drupal rules: https://www.drupal.org/project/rules