Group access to downloadable files - best approach?

I'm migrating a site to Modx & have a slightly odd requirement that I am not sure how to best approach.

The site has groups of files [pdfs mostly] that should only be available to certain user groups, over 50 groups at the moment each would only have access to their set of files. I'm pretty sure I can do this fairly easily by:
- creating the user/group for each set of files
- upload the files using the file manager
- create static resources for each file under that user/groups protected pages[resources]
- set the access control on the static resource to that user's group

Some of the files should be public, but I don't see a problem with that right now. My question is what is the best approach to secure the files from general public browsing? I would like the document folders/structure to be outside of the web root. True the links would n be publicly seen, but someone who has logged in could share the link to a PDF no problem.

So - what is the best approach to take for this requirement?

-thanks
-sean

Would it work to just put the files somewhere safe (e.g. above the web root), and provide a protected page with links to them? That would be easier.

- then the files are not directly accessible by the webserver.
Thing is some files need to be 'hidden' from view while others are OK to be public. I would much rather use a GetResources tag to grab and display the files[links] and let Modx permissions handle the rest.

-sean

I think the trouble with that strategy is that anyone could download any of the files if they could guess the path to them.

Some ideas here:

http://www.webmasterworld.com/php/3583097.htm


http://www.higherpass.com/php/Tutorials/File-Download-Security/


http://www.lunawebs.com/blog/2008/02/22/secure-file-download/


If you want to use getResources with this, you'd have to make a separate download page for each file, because getResources aggregates resources, not files.