I have been asked to control access by different groups of users to files uploaded to a website.
This covers both files uploaded as a field, and files uploaded via IMCE and CKEditor.
I have several Roles to handle; Anonymous users, Authenticated Normal User, Authenticated Coordinator. And probably some more later.
There are already Permissions controlling access of users to relevant nodes and forum topics. For example, an anonymous user can only see the public part of the site, the normal user can see some content types and forums and coordinators can see everything a normal users can see as well as some extra forums.
I need files uploaded by authenticated users in the restricted part of the site to 100% not be accessible to anonymous users. And, I need documents uploaded by the coordinators to not be accessible by the normal users.
Currently, normal users can bypass the node and topic permissions to access files if they have the direct link.
How should we approach this?