How to programmatically grant access to private files?

If you do not return -1 for different 'checks' in hook_file_download, isnt that basically granting access? `If the user does not have permission to access the file, return -1. If the user has permission, return an array with the appropriate headers. `

To your first question, no, not how it works. All modules return results to build up array which is checked by the download function in core. If any module (like the core file module) returns a -1; then it doesn't matter what my custom module returns as there is already a -1 in the array and that causes access denied. So, as i said above, i can limit access in my code; but i can't grant it.

Yes you can use it to grant access (by headers as Kevin mentioned), but you can’t use it to ignore/override another module’s explicit decision to deny access. Remember modules can return `NULL` if they have no interest in the file, so any explicit decision to deny should be respected by default. If you don’t trust or can’t rely on that other module’s decision-making, you can short it out by implementing hook_module_implements_alter to remove the module’s implementation of hook_file_download altogether

You can't explicitly use this hook to grant access (as i said). Deny has priority. That being said, i think I am going at this wrong. Private file access is determined by the access of the entity it is attached to and that's the issue. Why does my client want to allow access to the file and not the entity it is attached to? We will sort out that requirement. But, if indeed this is the case, there is a module to allow access by role to private files (but for the reasons stated above; it likely doesnt work). This would open up to more people than desired; but then hook can be used to limit.

I sit in a Tesla and translated this thread with Ai: