Changing permission on node access that linked with other nodes

Question

I have a Jobs type content which include a user reference field

I have another content type called Applications which includes a node reference field that links to Jobs.

Register applicants can apply for Jobs via Applications, permissions have been set so only individual applicants can view their own applications and not anyone's else.

I want to set permissions so recruiters can only view applications to their own Job content type and not anyone's else. I can do this in views but if a recruiter knows another recruiters Application url (i.e /application/4) then the recruiter can view that application as well, in this example change the url to /application/5.

Answer 1

You can do this in hook_node_access().

You didn't mentioned if this is for D7 or D8, but this hook is available in both.

This hook provides the node and the account object. So you have all data you need to calculate the permission.

Answer 2

This can be done using rules.

For example.

Content is viewed of type Application

Compare the author id of the node in the referenced field with current user id.

If it matches, you can redirect to the home page or can do what ever you want to do at this point.

Here is the exported rule which is working.

{ "rules_acces_own_job_applications" : {
"LABEL" : "Acces Own Job Applications",
"PLUGIN" : "reaction rule",
"OWNER" : "rules",
"REQUIRES" : [ "rules" ],
"ON" : { "node_view--application" : { "bundle" : "application" } },
"IF" : [
  { "NOT data_is" : {
      "data" : [ "node:field-job:author:uid" ],
      "value" : [ "site:current-user:uid" ]
    }
  }
],
"DO" : [ { "redirect" : { "url" : [ "site:url" ] } } ]
}
}

Answer 3

Okay, so here is an answer using only Views.

The following requirements were identified in the OP:

1. A recruiter creates a Job node
2. An applicant creates an Application for a specific job (linked from Application to the Job using an entity reference field).
3. A recruiter should see all Applications for a Job, only if she created the Job node.

You need to do the following:

1. Create a View that displays Nodes of Type = Jobs.
2. Add the Node's ID as a Contextual Filter to the View
3. Add one "Content: Author" relationship to your View, make it mandatory and name it recruiter. This will allow you to use the current user as a filter.
4. Add a "User: Current" filter to your view, selecting the currently logged-in user to match the content's (in this case Job) author and the "recruiter" relationship.

At this point, your View, running via a URL like "/applications-for-job/4" should allow recruiters to see a list of their jobs only and no one else's.

5. Add a relationship - a reverse one - "Entity Reference: Referencing entity" to your view, to link Jobs to the Applications that point to them. Make this mandatory. It should come with a name like "Content referencing Content from field_job".
6. Add a second "Content: Author" relationship and this time set it up to use the relationship from step 5. Makes this mandatory. You can call this "applicant".
7. Configure your fields to use the relationship from step 5, so that Application data are displayed; optionally add user data to your fields and use the "applicant" relationship for these.

You should have what you asked for by now, a recruiter can only view Applications for a specific Job, only if here created that Job, by visiting the URL "/applications-for-job/JOB_NID".

Here is a screenshot of the finished View for reference:

Best of luck!