Drupal (+CCK) permissions based on related node field

Question

Suppose I have two content typs, "Job Listing" and "Job Application". A job application has a field (using the CCK module) to reference the job listing (a required field). Suppose the job application has a field "Status" with values like "new", "accepted", "rejected".

I would like to set permissions so that the job application status can only be set by the creator of the job listing it corresponds to. If there is an addon that can do this great. I would also like general direction as to how a custom addon might implement this.

(I am following the scenario in Ch. 3 of O'Reilly's "Using Drupal")

Answer 1

I don't know if there is a module for this but this can be done pretty easily with some custom code though.

1. Use hook_form_alter to add your own validate handler to the node_edit form for the application content type.
2. Check to see if the value has changed
3. Set an error is user isn't the creator or has the administer content permission.
4. You're done.

Answer 2

Directions by googletorp are on the right track but you will have to take care of some more permissions also.

• Remove the edit own permission for the application content type.
• Also you probably do not want author of one job listing editing the applications in response to some other job listing. This is hard to do with any built in permissions. So check in the form_alter hook that current user is the same as the author of the job listing to which the application being edited is connected to.