Views - Protect user-assigned content from direct url access I'd like to create a restricted area from scratch using views.

What I'd like to achieve:


The admin creates a photo album and assigns it to a photographer
A photographer is able to log into the site, and see a list of albums that are assigned to them
The photographer can upload photos to the album
If a non logged user tries to access the album by typing its url, they get rejected
Ideally, photos (the files themselves) that are in an album are also protected, I know that file access restriction is a complex subject, but I'm okay with a sort of proxy-page that would then redirect to the file with an unguessable url, or a solution of this type.


Where I am so far:


Create a user role Photographer
Create a content type album with fields:


Photographer (user reference, role=photographer)
Photos (file, number of values unlimited)

Create a view to list content type=album, with a contextual filter on the Photographer field that defaults to current user id when not provided in the url. So that a logged photographer only sees their own albums. That works fine.


My problem:


Anyone can enter an album's url and access it directly [solved]
Anyone can enter a photo's url and download it [solved]


I've built this on drupal 8 but can also use drupal 7 and other modules. Any help would be very much appreciated!



Update:

I think I found part of the answer. Using private directory with the files module: https://www.drupal.org/documentation/modules/file. According to the docs:


  For example: you have created a new content type with a file field
  which stores files in your site's private file directory. Next you
  create a node from this new content type and attach two new files.
  When the node is published links to both attached files are visible
  and anyone who can view the node may download the files. Now, if you
  unpublish the node, all attached files become inaccessible for
  download even if you use the direct link to the files that worked when
  the node was published.
Have a look at the Group module which allows for creating arbitrary collections of your content and users on your site, and grant access control permissions on those collections. It is available as of D7, and has a D8 version also.

The Group module creates groups as entities, making them fully fieldable, extensible and exportable. Which also makes it integrate very well (out of the box) with commonly used modules such as Rules, Views, etc.

For more details about the various roles and permissions, refer to my answer to "What are the various roles supported by the Group module?".

Resources


Community documentation for the Group module.
Video tutorial "How to use the Group module in Drupal 8 to manage editorial access control to different areas of a web site".