How to have one node's access dependent on another node's access? I've got two content types. One we'll call "company"; the other, we'll call "project".  Companies can have projects, managed by a field in the project.  Companies and projects can also have fields that determine their visibility; each of them can be marked "public" or "private".  Node access rules are used to control access to the nodes, based on the value of that field.  All of this is working fine.

What I'd like to do is make it so that, if a company is marked "private", all of its projects also become private, in the sense that people other than the company's owner get access_denied if they try to look them.  However, if the company's access is returned to "public", the access rights of the projects are restored to whatever their own visibility setting specifies.

Here's what works for me at the moment.  My concern is that it requires directly hacking the node_access table, which, aside from the fact that it works, bothers me...

Add two bits of code to the company's _node_access_records() handler:


When the company's visibility changes from public to private, for each of the company's projects: blow away the entries for the project in the node_access table and insert a "only the author can access" right.
When the company's visibility changes from private to public, for each of the company's projects: again blow away the entries for the project in node_access, but this time get the access rights for the project by calling its node_access_records() handler and insert the corresponding rights into node_access for that project. 


Any other ideas out there, perhaps something that (in particular) avoids the direct hacking of node_access?
Create a custom module.

Use hook_node_view to run some code whenever a project node is viewed. 

In that custom hook, find the company nid by looking at the field of the current node. 

Then use node_load to get a node object of the company, check the company's access and then call drupal_access_denied if the current user does not have access to that company.