gistfile1.php

<?php
/**
 * @file
 * This module controls the access to view profile nodes and its email address
 * field.
 */

function mh_profile_access_form_alter(&$form, &$form_state, $form_id) {
  if($form['form_id']['#value'] == 'profile_node_form') {
    dpm($form);
    $form['field_first_name']['und'][0]['#title'] = t("Sepp");
    $form['field_first_name']['und']['#title'] = t("Sepp");
    dpm($form);
  }
}


/**
 * Implementation of hook_permissions().
 */
function mh_profile_access_permission() {
  return array(
    'profile view any content' => array(
      'title' => t('Profile: View any content'),
    ),
    'profile view edit own content' => array(
      'title' => t('Profile: View/Edit own content'),
      'description' => t('View or Edit profile which refers to own user.'),
    ),
    'profile view assigned content' => array(
      'title' => t('Profile: View assigned content'),
      'description' => t('View profiles from accepted requests on assigned properties.'),
    ),
  );
}

/**
 * Define global grant ID.
 */
define('MH_PROFILE_ACCESS_GRANT_ALL', 1);

/**
 * Implementation of hook_node_access_records().
 * Create locks for accessing request nodes.
 */
function mh_profile_access_node_access_records($node) {
  /**
   * Only content type profile.
   * Only records for published nodes.
   */
  if($node->type == 'profile' && $node->status) {
    $grants = array();

    /**
     * Lock for general view access.
     * Grant ID is global.
     */
    $grants[] = array(
      'realm' => 'mh_profile_access_all',
      'gid' => MH_PROFILE_ACCESS_GRANT_ALL,
      'grant_view' => 1,
      'grant_update' => 0,
      'grant_delete' => 0,
      'priority' => 0,
    );

    /**
     * Lock for user access own assigned profile.
     * Grant ID is the ID of the referenced user whom belongs the profile.
     */
    // Only if profile has referenced user.
    if(!empty($node->field_profile_user)) {
      // Get user id.
      $uid = $node->field_profile_user['und'][0]['target_id'];

      // Create Lock.
      $grants[] = array(
        'realm' => 'mh_profile_access_user',
        'gid' => $uid,
        'grant_view' => 1,
        'grant_update' => 1,
        'grant_delete' => 0,
        'priority' => 0,
      );
    }

    /**
     * Lock for referenced agency view access.
     * Grant ID is the ID of the referenced agency.
     * Only this User could access with this record.
     * Only profiles of accepted requests are accessible.
     */
    // Check if there are requests from this profile.
    $query = new EntityFieldQuery();
    $query->entityCondition('entity_type', 'node')
      ->entityCondition('bundle', 'request')
      ->fieldCondition('field_requestor', 'target_id', $node->nid, '=');
    $results = $query->execute();

    // if there are requests from this profile.
    if(!empty($results)) {
      foreach($results['node'] as $request) {
        // Load request object.
        $request = node_load($request->nid);
        // Only if request was accepted.
        $flag = flag_get_flag('accept_request');
        if($flag && $flag->is_flagged($request->nid)) {
          // Only if requested property exists.
          if(!empty($request->field_request_property['und'])) {
            // Get property id.
            $propertyId = $request->field_request_property['und'][0]['target_id'];
            // Load property object.
            $property = node_load($propertyId);
            // Only if property has assigned agency.
            if(!empty($property->field_assigned_agency['und'])) {
              // Get agency id.
              $agencyId = $property->field_assigned_agency['und'][0]['target_id'];

              // Create Lock.
              $grants[] = array(
                'realm' => 'mh_profile_access_agency',
                'gid' => $agencyId,
                'grant_view' => 1,
                'grant_update' => 0,
                'grant_delete' => 0,
                'priority' => 0,
              );
            }
          }
        }
      }
    }

    return $grants;
  }
}

/**
 * Implementation of hook_node_grants().
 * Create keys for accessing profile nodes.
 */
function mh_profile_access_node_grants($account, $op) {
  $grants = array();

  /**
   * Create a key if a user has 'profile view any content' permission.
   * Grant ID is global for all users with this permission.
   */
  if($op == 'view' && user_access('profile view any content', $account)) {
    $grants['mh_profile_access_all'] = array(MH_PROFILE_ACCESS_GRANT_ALL);
  }

  /**
   * Create a key if a user has 'profile view edit own content' permission.
   * Grant ID is the User ID.
   */
  if(($op == 'view' || $op == 'update') && user_access('profile view edit own content', $account)) {
    $grants['mh_profile_access_user'] = array($account->uid);
  }

  /**
   * Create a key if a user has 'profile view assigned content' permission.
   * Grant ID is the User ID.
   */
  if($op == 'view' && user_access('profile view assigned content', $account)) {
    $grants['mh_profile_access_agency'] = array($account->uid);
  }

  return $grants;
}



// @todo rebuild on flag change