How can I set per file access controls by role to files on a node I'm migrating a publications database from an old CMS to drupal 7 using the migrate module.  One of the requirements is that some publications (nodes of content type document) will be available to the public (anonymous users and everyone else) and some will be staff only (administrators, staff, and probably some higher level roles created for content editing).  Each publication can have an arbitrary number of associated files, each of which can also be publicly available or internal only (Same set of role based control).

How could I set this up?  So far my two possible solutions have been:


creating a different content type called files and using inline entity form to to associate thre file nodes with the publications.  This will allow me to ad a field for whether the file node is publicly available or not
Using the media module.  Unfortunately it appears that the Migrate Extras module that has media support doesn't support Media 7.2.x (As far as I can tell it is designed for 7.1.x).  I have tried installing Media 1.x but I have so far been unsuccessful at getting migrate to recognize the extra field as a destination field for migrate to write to.
The first thing to understand when you want to shield files from unauthorized access in Drupal is the difference between the Public and Private stream wrapper. By default files are uploaded in Drupal in a public directory and no matter what you do with access control on entities the files will be publicly available directly via the url to the file. So first make sure you setup Drupal to be able to serve files through Drupal via the Private file system (stream wrapper), instead of directly through the web server (public).
Take a look at "/admin/config/media/file-system". You can read more about this on Drupal.org.

In any case you will need an extra access control module (and/or custom code). If you don't use Media and only use the Private files stream wrapper you will be able to shield files per role using the Content Access module.

If you want Media not only for access but also for the other nice features it brings think about this: it will not solve your file access issue out of the box. And the Content Access can't help you anymore because it really only works for nodes and not for File entities. Because Media depends on File Entity (separate module since version 2.x) you are no longer required to create node types for documents that need to be fieldable, this is nice. But currently there are no good contributed modules I know of that add granular access control to file entities. So you will need custom code to manage access. I could help you out in this case, but I guess it should be a separate question.

Edit:

I extracted a custom sample module from a project of mine which adds role based permissions to File Entities (untested), see:
https://github.com/dmsmidt/drupal_file_entity_access