Hook for checking permissions via SESSION-variable instead of user

[vanderbreye]

I want to hide pages in searches / views / lists, etc. which the user is not allowed to see. The system is not based on Users/roles, but on a special $VAR in the $SESSIONCOOKIE..

if $page->users contains a value which is also in the $sessionvar of the viewing user, it should be viewable, otherwise it should not appear in any lists/searches/views...

I know that its not secure in any way - this morel less should be some pseudo-restriction to keep UI/UX simple for some users...
I think i need a BEFORE-Hook somewhere to keep things hidden in pageviews/lists/searches - but how to start?


Important: this should also work for all children of a page - if the parent is restricted, all child pages should be invisible, too.

[vanderbreye]

Im now trying something like this:

https://processwire.com/talk/topic/6142-hide-page-tree-in-the-admin/#entry60087

inside an own autoload module (used the helloworld-module) – but it doesnt work - all pages are still shown (front & backend)

UPDATE: 
it works, but i can only restrict access through the frontend - searches will be unaffected, the page will be found by $page->find() functions..
is there a way how to hide the page in searches as well?

what does not work, though the Page::viewable works: 
 

public function init() {
 $this->addHookAfter('Page::listable', $this, 'hookPageListable');
}

public function hookPageListable($event){
     $page = $event->object;
      $event->return = false; // set listable to false if template "internal-page"
}

could this be a problem of where it is implemented? does the search use this Hook, if implemented in the helloworld-module?