Access control based on session Currently I am making a website for restaurants. In the site, each restaurant is a node type and a menu item is another node type. The relationship between restaurant and menu items is one to many.

What I am doing is that after user creates and saves a restaurant node, the user session will keep the newly-created restaurant node id, based on that id, user can create multiple menu items for this restaurant.

What I want to make is that only when there is a restaurant id in user's session can user go to menu item add page, otherwise they cannot do that.

So how can I add this menu-item-add-page access control based on user's session?

Cheers!
I might suggest using Rules, Node Limit and Field Permissions for this... something like:


limit the user to creating one node (restaurant) type
create a field for the user, alter its access using Field Permissions, so they can't see or change it
use Rules on the event of new content created (restaurant), assign that user Field the node id of the newly created node
using Rules again, assign the appropriate field in any further node creation (menu item) using the user field value (which now contains the node id of the restaurant)
using Rules again, check url for /node/[menu-item]/add and see if that user has a user field containing a node id - if no id, redirect to a message screen saying they have to create a restaurant first


In this way, you limit each user to one restaurant, assign a permanent value to that user for the restaurant they create, and make some checks to ensure they have an assigned node id before they are able to create a menu item.

Rules:


  The Rules module allows site administrators to define conditionally
  executed actions based on occurring events (known as reactive or ECA
  rules). It's a replacement with more features for the trigger module
  in core and the successor of the Drupal 5 workflow-ng module


Node LImit:


  The Node Limit module allows administrators to restrict the number of
  nodes of a specific type that roles or users may create. For example,
  if a site has an "Advertiser" role that can create "advertisement"
  nodes, then the node limit administrator can restrict all users in
  that role to a specific number of nodes. He may also restrict users on
  a per-user basis.


Field Permissions


  The Field Permissions module allows site administrators to set
  field-level permissions to edit, view and create fields on any entity.