Edit/remove permissions from out-of-the-box actions

onurg

Hi all!

I'm trying to add new user roles and one of the roles should be able to move other users' files but not delete them. My new user role includes permission groups "Collaborator" and "AddChildren":

<permissionGroup name='MySiteRole' allowFullControl='false' expose='true'>
    <includePermissionGroup permissionGroup='Collaborator' type='cm:cmobject' />
    <includePermissionGroup permissionGroup='AddChildren' type='sys:base' />
</permissionGroup>

The code segment above is from "customSitePermissionDefinitions.xml" which I register via beans in "bootstrap-context.xml". All of my new roles are visible in the "share" and they can be assigned to users for sites without any problems.

As far as I know, I need to use share-config-custom.xml in order to make changes to the actions. Per default, the "move" action depends on the "delete" action as you can see here.  I want to edit/remove the "permissions" part from the "move" action. This is the code I added to share-config-custom.xml to change that:

<config evaluator="string-compare" condition="DocLibActions">
    <actions>
      <action id="document-move-to" type="javascript" label="actions.document.move-to">
        <param name="function">onActionMoveTo</param>
        <permissions>
          <permission allow="true">AddChildren</permission>
        </permissions>
        <evaluator>evaluator.doclib.action.editableByCurrentUser</evaluator>
      </action>
    </actions>
  </config>

In this case, I want to make the "move" action dependent on "AddChildren", however, I still can't move the files of other users with my new user role. Am I missing something or do I need another approach to achieve my goal?

Thanks in advance.

Onur

abhinavmishra14

At the core move operation is combination of delete and create operation, hence move needs 'Delete' permission. You can't remove it.

Simplest approach would be that, you should develop your custom role e.g. CustomCollaborator by extending the permissions of Collaborator which has at least Write permissions.

Update the share config to use: <permission allow="true">Write</permission>, so that action gets available to the custom role even if the user doesn't have delete permission. 

<action id="document-move-to" type="javascript" label="actions.document.move-to">
	<param name="function">onActionMoveTo</param>
	<permissions>
		<permission allow="true">Write</permission>
	</permissions>
	<evaluator>evaluator.doclib.action.editableByCurrentUser</evaluator>
</action>

Write a custom rootscoped object (basically a service available as root scoped object so that it can be used in move-to.post.json.js webscript) that will have logic to exeucute move operation as system user. 

AuthenticationUtil.setRunAsUserSystem();
try {
	FileInfo fileInfo = null;
	if (null == sourceParentNodeRef) {
		fileInfo = fileFolderService.move(sourceNodeRef, targetParentNodeRef, null);

	} else {
		fileInfo = fileFolderService.moveFrom(sourceNodeRef, sourceParentNodeRef, targetParentNodeRef, null);
	}

	....
	.....
	........
} catch (Exception excp) {
	throw new ScriptException("Can't move selected node", excp);
} 

And extend 'org\alfresco\slingshot\documentlibrary\action\move-to.post.json.js' repository webscript where you need to add your custom logic to check the role and if role matches your custom role use custom rootscoped object to call the move.

if(null != role && (role == "CustomSiteCollaborator" || role == "CustomCollaborator")) {
	var parentNodeRef = null;
	if (parent != null) {
		parentNodeRef = parent.nodeRef;
	}
	// Move the node via custom move rootscoped object
	result.success = customMove.move(fileNode.nodeRef, parentNodeRef, destNode.nodeRef);
} else {
	// Move the node via OOTB move to service
	result.success = fileNode.move(parent, destNode);
}