support for private images

Apparently this is controlled via hook_file_download_access.

Here's a patch.

Apparently this is controlled via hook_file_download_access.

Here's a patch.

yes, this is what eventually controls the view of styled image: image_style_deliver() invokes file_download hooks.
The method used in this patch is also how the node module implements the hook.
After applying patch, I was able to see a thumbnail private image in the edit form and on a views list.

Alrighty, committed. This won't cause any trouble with Commerce File, will it recrit? Like automatically give access to a user to any file attached to a product a user has view access to?

no this will not effect it.
The hook_file_download_access() is called from file's implementation of hook_file_download(). Commerce File also implements hook_file_download().
hook_file_download() is a denial based hook, so even if the file module's hooks grant access to the file then commerce_file can still deny access. Conversely, if commerce_file allows access, then other modules still get a say to deny it.

Excellent - that's what I was unsure of -> is it denial based or grant based. Thanks for the explanation. : )

See http://drupal.org/node/1157266 for a field-level access control option, suitable for that function context.

So, for example a user can view a product, but not download an attached file, honoring the field access control rules.

The alternative patch also includes the standard hook implementation documentation for completeness.

Direct patch link: http://drupal.org/files/issues/commerce_product.module.v2.patch

DT

The hook_file_download gets called in this case by image module to check download access before creating a new image style.
There is a hook_field_access() where this type of access control should be implemented... however, I'm not convince that a module defining an entity should define this.

The current patch fails on existing installs because the entity name has changed from product to commerce_product.
I prefer my other patch on http://drupal.org/node/1157266#comment-4468168 which doesn't have this limitation

Closing this since we have the other issue.