How to revoke edit access to the node's author after publishing a node? I am trying to build a new rule on Drupal 7 with both the Rules and Content Access modules (and its sub module Content Access Rules integration). Thus, I get new actions like "grant or revoke an access" for specific role.

An authenticated user can add a content on the website but it is unpublished by default (like a draft).

When the user is ready, he/she can publish the content (different modules can do that, Save Draft, Publish content).

After the content is published (which event?), I need to revoke the modification access for the node author.

I have tried to build the rule as this tutorial shows but without Flag.

It does not work, the author can still edit the content after publication and no modifications have been made on access control for this node (I have checked the "Per content node access control settings" box in the content type settings).

I guess the problem is the non-published state of my node and thus the lack of access settings, since Content Access needs published nodes to operate. Then, I ask Rules to modify content access that does not exist ...

A custom module is available here but I would rather use the Rules module since, theoretically, it could be done.

Here is an export of my rule code :

{ "rules_revoke_edit_access_after_publication" : {
    "LABEL" : "Revoke edit access after publication",
    "PLUGIN" : "reaction rule",
    "OWNER" : "rules",
    "REQUIRES" : [ "rules", "content_access_rules" ],
    "ON" : { "node_update--manuscript_submission" : { "bundle" : "manuscript_submission" } },
    "IF" : [ { "data_is" : { "data" : [ "node:status" ], "value" : "1" } } ],
    "DO" : [
      { "content_access_action_revoke_node_permissions" : {
          "node" : [ "node" ],
          "permissions" : { "value" : [
              "view:3",
              "view_own:3",
              "update:3",
              "update_own:2",
              "update_own:3",
              "delete:3",
              "delete_own:3"
            ]
          }
        }
      }
    ]
  }
}


Default access for authenticated user : view/modify own content (+ view any unpublished content (of the content type needed) thanks to the View unpublished module)

Access needed after publication : view own content only.
Approach 1:

Here is the rule (in Rules export format) that I think is what you are looking for:

{ "rules_disallow_edit_own_content_after_node_is_published" : {
    "LABEL" : "Disallow edit own content after node is published",
    "PLUGIN" : "reaction rule",
    "ACTIVE" : false,
    "OWNER" : "rules",
    "REQUIRES" : [ "rules", "content_access_rules" ],
    "ON" : { "node_update--manuscript_submission" : { "bundle" : "manuscript_submission" } },
    "IF" : [
      { "data_is" : { "data" : [ "node-unchanged:status" ], "value" : "0" } },
      { "data_is" : { "data" : [ "node:status" ], "value" : "1" } }
    ],
    "DO" : [
      { "content_access_action_revoke_node_permissions" : {
          "node" : [ "node" ],
          "permissions" : { "value" : [
              "view:3",
              "view_own:3",
              "update:3",
              "update_own:2",
              "update_own:3",
              "delete:3",
              "delete_own:3"
            ]
          }
        }
      }
    ]
  }
}


Just import this rule in your own environment to review/qa-test it. 

Some more details about the "clue" (magic?) of this rule:


The Rules Event is related to "Updating a node of content type manuscript_submission.
The Rules Condition is to ensure that the Rules Action is only triggered the moment that the node changes from unpublished to published.
The Rules Action simply REMOVES the permission for the author of the node (cfr. "own" in Content Access terminology) to edit that node for rome "authenticated user".


Note: The above rule is "tuned" to content type with machine name manuscript_submission. Change that machine name to any other content type (eg: article). Make sure to perform such change before you actually import this rule (because the Rules UI do not allow you to change that "event" after importing anymore).

Approach 2:

You can also use a work-around to implement "... revoke the modification access for the node author..." that you are asking for, as detailed below.

Have a look at my answer to the question about "How to specify a Rules condition like &#39;Before creating new content&#39;?". Here is a quote from it, which I also recommend in your case here:


  Try using Rules (System) event "Drupal is initializing" (= init), which is actually BEFORE your edit form is shown.


With that, you actually don't (have to) "revoke access", instead you just the Rules module to capture the Rules event that somebody is about to start an edit session of a node. And then, depending on the extra Rules conditions you want to check (in your case: 'is the current user the author of this node?' AND 'is the status of this node published?'), you just use a Rules action to redirect a user to "somewhere else" (instead of showing them the edit form they asked for).

Note: If you want to use my proto-type Rules example in my answer I mentioned above, it's obvious that you'll have to adapt the Rules conditions and/or Rules actions to make it fit for you case (like the URL of your edit form?).