What is the simplest, most drupalish, way to restrict access to some content to authenticated users or a certain role? I am creating a publications database that is used by staff to input their publications.  Some of these publications are available to the public, and some are not.  Additionally, the publications have files associated with them, some being public and some not.  I have a number of content types for different types of publications with a boolean public field, and two seperate file fields, one for public and one for internal files.  I currently have one user role (Staff member) though the number of roles is likely to increase slightly to allow for administrators and a content approval workflow.


Content Type a


Public?
Public Files
Internal Files

Content Type b


Public?
Public Files
Internal Files



The idea is that all the publications lists should show a list of public documents to non-authenticated users, and a list of all documents to authenticated users of the right role.

My initial thought is to create two different views for each page with different access settings on each.  The first being a page that doesn't check the public field and includes the non-public files field, and a second, available to anyone, that filters to publications where the public field is set to true, and does not include the internal files field, and a few other fields only of interest to staff.


node list view


view a


access: staff only
filter: Published nodes


node list view


view b


access: no restriction
filter: Published nodes AND public is true


node view


view a


access: staff only
filter: Published Nodes
fields: All Fields, including internal files

view b


access: no restriction
filter: Published Node AND marked public
fields: don't display internal files, some other fields




Is this the simplest, most drupalish approach?  Would it make more sense to control the fields used through the view or via view mode (Full Content, Teaser, etc.)  I'm still somewhat new to working with Drupal, and find that I'm fighting it at every turn, that makes me think, I must be thinking the wrong way for working with a drupal site.

Further Information: I'm actually reimplementing this from an existing system, and am using the Migrate module to bring in thousands of entries, so I have to be able to specify as part of the migration in some way, what the permissions should be.
Content Access

This module allows you to manage permissions for content types by role and author. It allows you to specifiy custom view, edit and delete permissions for each content type. Optionally you can enable per content access settings, so you can customize the access for each content node.

Video Tutorial
Field Permissions

The Field Permissions module allows site administrators to set field-level permissions to edit, view and create fields on any entity.



Your views approach is fine, assuming everything you need is in the view.
But if you want to restrict access to nodes, then you're better off using Content Access.
For example: If your view was listing links that you don't anonymous to access (eg: premium content) you would want to use the Content Access module because if anonymous users somehow get a hold of the direct link then they could see the premium nodes.