Preventing some users from viewing/editing a specific sub-contact type?

Question

I am using CiviCRM v5.66 on WordPress v6.4.2, and using using the WordPress Access Control.

I have created a new Individual sub-type contact called MySubType. I have created a new WordPress role called MySubType_Role (duplicate of subscriber role).

For users that have some or all of "add/edit/view/delete contacts", I want to prevent these users from accesssing MySubType contacts (add/edit/view/delete), and only grant access to users if I assign the WordPress MySubType_Role to them.

Is there a way to do this with code from my custom extension I already have installed? I am using Traditional Hooks... not sure if this would use any Database hook or Form hook as well as some of the Permission hooks: https://docs.civicrm.org/dev/en/latest/hooks/list/

I do not know the proper code to use, so this is just an example of the logic of the code:

if ( user_has_permission_to(add/edit/view/delete contacts) ) {
  if ( contact_sub_type == "MySubType" ) {
    if ( current_user_has_wp_role == "MySubType_Role" ) {
      grant_access(add/edit/view/delete this contact); //GRANT accesss to sub-contact type
    } else {
      deny_access(add/edit/view/delete this contact); //DENY access to sub-contact type
    }
  }
}

Answer 1

As you probably are aware, ACLs are inherently complex, usually more than you realise before digging into them.

A non-code approach might be to create a smart group on the subtypes, and then use the acl ui configuration tools to try and limit access, but that might be a lot more clumsy than you want.

Preventing access is usually broken down in to permissions to edit, delete, view and list. So you might want people to list them but not see details, etc.

One challenge with the requirements you have described is that contact data can be exposed in multiple ways, e.g. using profiles, or even cms tools (e.g. drupal), so your solution will probably have to depend on balancing the likely hood of various tools being in use vs. how important it is to prevent access.

But, to accomplish your goal in the way you're describing, I believe you'd want to implement this hook:

https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_aclWhereClause/