File access control at field level rather than template

[DrQuincy]

In a template you can enable:

Prevent direct access to file assets owned by pages using this template?

And in site/assets the folder of that page has a minus prefix added so Apache tells PW to handle the file request.

I have a situation where I want the top level page to have no access control but I also have a series of files where I need access control. I.e. it's a mix. I'm just wondering if I make the files be part of a repeater, can I set access control for the repeater only since it has its own ID. Will this work?

I would guess that it does but I wanted to see if anyone has used this approach in production. 

[monollonom]

2 hours ago, DrQuincy said:

I'm just wondering if I make the files be part of a repeater, can I set access control for the repeater only since it has its own ID. Will this work?

Funnily I tried exactly this yesterday and no unfortunately it doesn’t work because the repeater will check the access control of the page holding it. However it could a request to add a line to check if its access control is on, something like:

public function getAccessTemplate($type = 'view') {
	if($this->template->useRoles) return $this->template;
	$p = $this->getForPageRoot();
	return $p->id ? $p->getAccessTemplate($type) : parent::getAccessTemplate($type);
}

I tried and it worked but it wasn’t a fit in the end for what I was trying to achieve.

[DrQuincy]

Thanks for that, and what a happy coincidence!

I'm not sure I want to edit the core at this point but I appreciate your code snippet. I think my other idea is going to take a bit more work but can be done with hooks:

1. Create a child template with access control and file field
2. Add Integer Unique field to store parent page ID
3. Add Pages::save hook to create and save child page (check for its existance first and create a new one if needed)
4. Add a ProcessPageEdit::buildForm on the parent template to add the access controlled field to the edit form
5. Add a Pages::delete hook to delete the child page when the parent page is deleted

I think that should do it. I'll have to try it out though. I was hoping there'd be a simpler solution!