Interface IAccessControlClient

interface IAccessControlClient {
    getDefaultFieldAccessControl(
        args: { repositoryId: string },
    ): Promise<LfRepositoryClientV2.FieldAccessControlList>;
    getDefaultTemplateAccessControl(
        args: { repositoryId: string },
    ): Promise<LfRepositoryClientV2.TemplateAccessControlList>;
    getEntryAccessControl(
        args: {
            entryId: number;
            includeInherited?: boolean;
            repositoryId: string;
            select?: null | string;
        },
    ): Promise<LfRepositoryClientV2.AccessControlList>;
    getEntryRights(
        args: {
            aclOnly?: boolean;
            entryId: number;
            repositoryId: string;
            select?: null | string;
            trusteeId?: null | string;
            trusteeName?: null | string;
        },
    ): Promise<LfRepositoryClientV2.EntryRights>;
    getFieldAccessControl(
        args: { fieldId: number; repositoryId: string },
    ): Promise<LfRepositoryClientV2.FieldAccessControlList>;
    getFieldRights(
        args: {
            aclOnly?: boolean;
            fieldId: number;
            repositoryId: string;
            trusteeId?: null | string;
            trusteeName?: null | string;
        },
    ): Promise<LfRepositoryClientV2.FieldRights>;
    getSessionRights(
        args: { repositoryId: string },
    ): Promise<LfRepositoryClientV2.SessionRights>;
    getTemplateAccessControl(
        args: { repositoryId: string; templateId: number },
    ): Promise<LfRepositoryClientV2.TemplateAccessControlList>;
    getTemplateRights(
        args: {
            aclOnly?: boolean;
            repositoryId: string;
            templateId: number;
            trusteeId?: null | string;
            trusteeName?: null | string;
        },
    ): Promise<LfRepositoryClientV2.TemplateRights>;
    getTrusteeSecurity(
        args: {
            includeInherited?: boolean;
            repositoryId: string;
            trusteeId: string;
        },
    ): Promise<LfRepositoryClientV2.TrusteeSecurity>;
    lookupTrustees(
        args: {
            count?: number;
            repositoryId: string;
            search?: null | string;
            type?: null | string;
        },
    ): Promise<LfRepositoryClientV2.TrusteeIdentity[]>;
    setDefaultFieldAccessControl(
        args: {
            repositoryId: string;
            request: LfRepositoryClientV2.SetFieldAccessControlRequest;
        },
    ): Promise<LfRepositoryClientV2.FieldAccessControlList>;
    setDefaultTemplateAccessControl(
        args: {
            repositoryId: string;
            request: LfRepositoryClientV2.SetTemplateAccessControlRequest;
        },
    ): Promise<LfRepositoryClientV2.TemplateAccessControlList>;
    setEntryAccessControl(
        args: {
            entryId: number;
            repositoryId: string;
            request: LfRepositoryClientV2.SetAccessControlRequest;
        },
    ): Promise<LfRepositoryClientV2.AccessControlList>;
    setFieldAccessControl(
        args: {
            fieldId: number;
            repositoryId: string;
            request: LfRepositoryClientV2.SetFieldAccessControlRequest;
        },
    ): Promise<LfRepositoryClientV2.FieldAccessControlList>;
    setTemplateAccessControl(
        args: {
            repositoryId: string;
            request: LfRepositoryClientV2.SetTemplateAccessControlRequest;
            templateId: number;
        },
    ): Promise<LfRepositoryClientV2.TemplateAccessControlList>;
}

Implemented by

Methods

getDefaultFieldAccessControl getDefaultTemplateAccessControl getEntryAccessControl getEntryRights getFieldAccessControl getFieldRights getSessionRights getTemplateAccessControl getTemplateRights getTrusteeSecurity lookupTrustees setDefaultFieldAccessControl setDefaultTemplateAccessControl setEntryAccessControl setFieldAccessControl setTemplateAccessControl

Methods

getDefaultFieldAccessControl

  • getDefaultFieldAccessControl(
        args: { repositoryId: string },
    ): Promise<LfRepositoryClientV2.FieldAccessControlList>
    • Returns the repository's default field ACL — the access control entries a new field definition inherits at creation time.
    • Required OAuth scope: repository.Read

    Parameters

    • args: { repositoryId: string }
      • repositoryId: string

        The requested repository ID.

    Returns Promise<LfRepositoryClientV2.FieldAccessControlList>

    Successfully returned the default field access control list.

getDefaultTemplateAccessControl

  • getDefaultTemplateAccessControl(
        args: { repositoryId: string },
    ): Promise<LfRepositoryClientV2.TemplateAccessControlList>
    • Returns the repository's default template ACL — the access control entries a new template definition inherits at creation time.
    • Required OAuth scope: repository.Read

    Parameters

    • args: { repositoryId: string }
      • repositoryId: string

        The requested repository ID.

    Returns Promise<LfRepositoryClientV2.TemplateAccessControlList>

    Successfully returned the default template access control list.

getEntryAccessControl

  • getEntryAccessControl(
        args: {
            entryId: number;
            includeInherited?: boolean;
            repositoryId: string;
            select?: null | string;
        },
    ): Promise<LfRepositoryClientV2.AccessControlList>
    • Returns the access control entries (ACEs) configured on the entry — by default both explicitly-set and inherited (inherited ACEs carry isInherited = true), or only the explicit ones when includeInherited=false — plus whether the entry inherits rights from its parent(s).
    • Each ACE names a trustee, whether its rights are allowed or denied, the rights themselves, and the propagation scope.
    • The repository session enforces the underlying permission: reading an ACL requires the ReadPermissions right on the entry, and a 403 is returned when it is lacking. The repository.Read OAuth scope is necessary but not sufficient.
    • Required OAuth scope: repository.Read

    Parameters

    • args: {
          entryId: number;
          includeInherited?: boolean;
          repositoryId: string;
          select?: null | string;
      }
      • entryId: number

        The entry whose access control list is returned.

      • OptionalincludeInherited?: boolean

        (optional) Optional. When true (the default), the response includes both the entry's explicit access control entries and the inherited ones (inherited ACEs carry isInherited = true). When false, only the explicit ACEs are returned — the exact set that the access-control PUT accepts — making it convenient to read, edit, and write back the ACL without filtering inherited entries client-side. The inheritParents flag is unaffected by this option.

      • repositoryId: string

        The requested repository ID.

      • Optionalselect?: null | string

        (optional) Limits the properties returned in the result.

    Returns Promise<LfRepositoryClientV2.AccessControlList>

    Successfully returned the entry's access control list.

getEntryRights

  • getEntryRights(
        args: {
            aclOnly?: boolean;
            entryId: number;
            repositoryId: string;
            select?: null | string;
            trusteeId?: null | string;
            trusteeName?: null | string;
        },
    ): Promise<LfRepositoryClientV2.EntryRights>
    • Returns the rights a trustee has on the entry. By default these are the effective rights — the same calculation the Laserfiche applications use, after allow/deny resolution, group membership, and the repository's privilege and records-management overlays. Set aclOnly=true to return only the rights granted by the entry's access control list (including its stored inherited ACEs) without the privilege/records-management overlays.
    • Identify the trustee by trusteeId (a SID) or trusteeName (an account name); omit both for the calling session.
    • isReadOnly reports whether the session is read-only, in which case no write operations are possible regardless of the granted rights.
    • Required OAuth scope: repository.Read

    Parameters

    • args: {
          aclOnly?: boolean;
          entryId: number;
          repositoryId: string;
          select?: null | string;
          trusteeId?: null | string;
          trusteeName?: null | string;
      }
      • OptionalaclOnly?: boolean

        (optional) Optional. Selects which rights are returned. Default (false): the trustee's effective rights — the net result after allow/deny resolution, group membership, and the repository's privilege and records-management overlays. When true: only the rights granted by this item's access control list — including inherited access control entries, which are stored on the item itself — without the privilege and records-management overlays (for example, a privilege that grants full control regardless of the ACL is reflected only when aclOnly=false). Group membership is always resolved. The aclOnly=true value is what the ACL editor displays as the net effect of the list.

      • entryId: number

        The entry whose rights are computed.

      • repositoryId: string

        The requested repository ID.

      • Optionalselect?: null | string

        (optional) Limits the properties returned in the result.

      • OptionaltrusteeId?: null | string

        (optional) Optional. The SID of the trustee to compute rights for. When omitted (along with trusteeName), the rights of the current session are returned.

      • OptionaltrusteeName?: null | string

        (optional) Optional. The account name of the trustee to compute rights for, as an alternative to trusteeId. When both are supplied, trusteeId takes precedence.

    Returns Promise<LfRepositoryClientV2.EntryRights>

    Successfully returned the rights for the entry.

getFieldAccessControl

  • getFieldAccessControl(
        args: { fieldId: number; repositoryId: string },
    ): Promise<LfRepositoryClientV2.FieldAccessControlList>
    • Returns the field's access control entries (ACEs): the trustee, whether rights are allowed or denied, and the rights themselves. Field ACEs have no scope and are never inherited.
    • The OAuth scope is coarse; the repository session enforces the real permission and returns 403 when the caller lacks the field's ReadPermissions right.
    • Required OAuth scope: repository.Read

    Parameters

    • args: { fieldId: number; repositoryId: string }
      • fieldId: number

        The requested field definition ID.

      • repositoryId: string

        The requested repository ID.

    Returns Promise<LfRepositoryClientV2.FieldAccessControlList>

    Successfully returned the field definition's access control list.

getFieldRights

  • getFieldRights(
        args: {
            aclOnly?: boolean;
            fieldId: number;
            repositoryId: string;
            trusteeId?: null | string;
            trusteeName?: null | string;
        },
    ): Promise<LfRepositoryClientV2.FieldRights>
    • Returns the rights a trustee has on the field definition, plus whether the session is read-only. By default these are the effective rights (after group membership, allow/deny resolution, and the privilege overlay); set aclOnly=true for the rights granted by the field's own ACL without that overlay. Omit both trusteeId and trusteeName for the current session.
    • Required OAuth scope: repository.Read

    Parameters

    • args: {
          aclOnly?: boolean;
          fieldId: number;
          repositoryId: string;
          trusteeId?: null | string;
          trusteeName?: null | string;
      }
      • OptionalaclOnly?: boolean

        (optional) Optional. Selects which rights are returned. Default (false): the trustee's effective rights — the net result after allow/deny resolution, group membership, and the repository's privilege overlay (for example, the metadata-management privilege that grants full control over every field regardless of its ACL). When true: only the rights granted by this field definition's own access control list, without that privilege overlay. Group membership is always resolved. Field definitions are not hierarchical, so there is no parent inheritance involved either way.

      • fieldId: number

        The requested field definition ID.

      • repositoryId: string

        The requested repository ID.

      • OptionaltrusteeId?: null | string

        (optional) An optional trustee SID. When supplied, returns that trustee's rights; otherwise the current session's.

      • OptionaltrusteeName?: null | string

        (optional) An optional trustee account name, as an alternative to trusteeId. The SID wins when both are supplied.

    Returns Promise<LfRepositoryClientV2.FieldRights>

    Successfully returned the rights for the field definition.

getSessionRights

  • getSessionRights(
        args: { repositoryId: string },
    ): Promise<LfRepositoryClientV2.SessionRights>
    • Returns the privileges and feature rights held by the current session, plus whether the session is read-only. Each is reported as named booleans (a map of right name to whether it is granted), for UI enablement and pre-flight checks.
    • Reflects the current session only. Per-trustee privilege administration is not part of this surface.
    • Required OAuth scope: repository.Read

    Parameters

    • args: { repositoryId: string }
      • repositoryId: string

        The requested repository ID.

    Returns Promise<LfRepositoryClientV2.SessionRights>

    Successfully returned the current session's rights.

getTemplateAccessControl

  • getTemplateAccessControl(
        args: { repositoryId: string; templateId: number },
    ): Promise<LfRepositoryClientV2.TemplateAccessControlList>
    • Returns the template's access control entries (ACEs): the trustee, whether rights are allowed or denied, and the rights themselves. Template ACEs have no scope and are never inherited.
    • The OAuth scope is coarse; the repository session enforces the real permission and returns 403 when the caller lacks the template's ReadPermissions right.
    • Required OAuth scope: repository.Read

    Parameters

    • args: { repositoryId: string; templateId: number }
      • repositoryId: string

        The requested repository ID.

      • templateId: number

        The requested template definition ID.

    Returns Promise<LfRepositoryClientV2.TemplateAccessControlList>

    Successfully returned the template definition's access control list.

getTemplateRights

  • getTemplateRights(
        args: {
            aclOnly?: boolean;
            repositoryId: string;
            templateId: number;
            trusteeId?: null | string;
            trusteeName?: null | string;
        },
    ): Promise<LfRepositoryClientV2.TemplateRights>
    • Returns the rights a trustee has on the template definition, plus whether the session is read-only. By default these are the effective rights (after group membership, allow/deny resolution, and the privilege overlay); set aclOnly=true for the rights granted by the template's own ACL without that overlay. Omit both trusteeId and trusteeName for the current session.
    • Required OAuth scope: repository.Read

    Parameters

    • args: {
          aclOnly?: boolean;
          repositoryId: string;
          templateId: number;
          trusteeId?: null | string;
          trusteeName?: null | string;
      }
      • OptionalaclOnly?: boolean

        (optional) Optional. Selects which rights are returned. Default (false): the trustee's effective rights — the net result after allow/deny resolution, group membership, and the repository's privilege overlay (for example, the metadata-management privilege that grants full control over every template regardless of its ACL). When true: only the rights granted by this template definition's own access control list, without that privilege overlay. Group membership is always resolved. Template definitions are not hierarchical, so there is no parent inheritance involved either way.

      • repositoryId: string

        The requested repository ID.

      • templateId: number

        The requested template definition ID.

      • OptionaltrusteeId?: null | string

        (optional) An optional trustee SID. When supplied, returns that trustee's rights; otherwise the current session's.

      • OptionaltrusteeName?: null | string

        (optional) An optional trustee account name, as an alternative to trusteeId. The SID wins when both are supplied.

    Returns Promise<LfRepositoryClientV2.TemplateRights>

    Successfully returned the rights for the template definition.

getTrusteeSecurity

  • getTrusteeSecurity(
        args: {
            includeInherited?: boolean;
            repositoryId: string;
            trusteeId: string;
        },
    ): Promise<LfRepositoryClientV2.TrusteeSecurity>
    • Returns the trustee's privileges and feature rights (as named booleans), the security tags assigned to it, the audit classes configured for it (split into success and failure masks), and whether the trustee is read-only.
    • The effective view (includeInherited=true) is a best-effort computation that can, in rare cases, differ from the trustee's real rights. The authoritative way to determine a trustee's security is to sign in as that trustee and read the resulting session's rights.
    • Required OAuth scope: repository.Read

    Parameters

    • args: { includeInherited?: boolean; repositoryId: string; trusteeId: string }
      • OptionalincludeInherited?: boolean

        (optional) When true (default), returns the trustee's effective security — what applies once group memberships are resolved. When false, returns the direct security assigned on the trustee record itself, without group-membership inheritance.

      • repositoryId: string

        The requested repository ID.

      • trusteeId: string

        The SID of the trustee whose security is read. Use the trustee lookup to resolve a name to a SID.

    Returns Promise<LfRepositoryClientV2.TrusteeSecurity>

    Successfully returned the trustee's account security (effective by default, or direct when includeInherited=false).

lookupTrustees

  • lookupTrustees(
        args: {
            count?: number;
            repositoryId: string;
            search?: null | string;
            type?: null | string;
        },
    ): Promise<LfRepositoryClientV2.TrusteeIdentity[]>
    • Resolves trustee names to the SIDs used when building access control entries or reading effective rights for a trustee.
    • Each result includes the trustee's SID, account name, display name, type, whether it is a user or group, and whether the account is disabled.
    • Required OAuth scope: repository.Read

    Parameters

    • args: {
          count?: number;
          repositoryId: string;
          search?: null | string;
          type?: null | string;
      }
      • Optionalcount?: number

        (optional) Optional. The maximum number of trustees to return. Defaults to 100.

      • repositoryId: string

        The requested repository ID.

      • Optionalsearch?: null | string

        (optional) The name (or name prefix) to search for.

      • Optionaltype?: null | string

        (optional) Optional. Restrict the search to user or group trustees. When omitted, both users and groups are returned.

    Returns Promise<LfRepositoryClientV2.TrusteeIdentity[]>

    Successfully returned the matching trustees.

setDefaultFieldAccessControl

setDefaultTemplateAccessControl

setEntryAccessControl

  • setEntryAccessControl(
        args: {
            entryId: number;
            repositoryId: string;
            request: LfRepositoryClientV2.SetAccessControlRequest;
        },
    ): Promise<LfRepositoryClientV2.AccessControlList>
    • Full replace of the entry's explicit ACEs: the supplied entries become the entry's complete set of explicit ACEs, and any explicit ACE not included is removed. An empty entries array clears all explicit ACEs.
    • Inherited ACEs cannot be supplied (entries flagged isInherited = true are rejected with 400); inheritance is controlled via inheritParents. When inheritParents is omitted, the entry's current inheritance setting is preserved.
    • Each ACE identifies its trustee by trustee.sid or trustee.accountName (an account name is resolved to a SID server-side; the SID takes precedence when both are supplied). A trustee that needs both allowed and denied rights is expressed as two ACEs.
    • The repository session enforces the underlying permission: changing an ACL requires the ChangePermissions right on the entry, and a 403 is returned when it is lacking. The repository.Write OAuth scope is necessary but not sufficient.
    • Returns the entry's full ACL after the change.
    • Required OAuth scope: repository.Write

    Parameters

    Returns Promise<LfRepositoryClientV2.AccessControlList>

    Successfully replaced the entry's access control list. Returned the updated access control list.

setFieldAccessControl

  • setFieldAccessControl(
        args: {
            fieldId: number;
            repositoryId: string;
            request: LfRepositoryClientV2.SetFieldAccessControlRequest;
        },
    ): Promise<LfRepositoryClientV2.FieldAccessControlList>
    • Full replace: the supplied entries replace the field's entire explicit ACL. Inherited entries are not accepted (field ACEs are never inherited). Address a trustee by trustee.sid or trustee.accountName (the SID wins when both are given; an account name is resolved to a SID server-side).
    • The OAuth scope is coarse; the repository session enforces the real permission and returns 403 when the caller lacks the field's ChangePermissions right.
    • Required OAuth scope: repository.Write

    Parameters

    Returns Promise<LfRepositoryClientV2.FieldAccessControlList>

    Successfully replaced the field definition's access control list. Returned the updated access control list.

setTemplateAccessControl

  • setTemplateAccessControl(
        args: {
            repositoryId: string;
            request: LfRepositoryClientV2.SetTemplateAccessControlRequest;
            templateId: number;
        },
    ): Promise<LfRepositoryClientV2.TemplateAccessControlList>
    • Full replace: the supplied entries replace the template's entire explicit ACL. Inherited entries are not accepted (template ACEs are never inherited). Address a trustee by trustee.sid or trustee.accountName (the SID wins when both are given; an account name is resolved to a SID server-side).
    • The OAuth scope is coarse; the repository session enforces the real permission and returns 403 when the caller lacks the template's ChangePermissions right.
    • Required OAuth scope: repository.Write

    Parameters

    Returns Promise<LfRepositoryClientV2.TemplateAccessControlList>

    Successfully replaced the template definition's access control list. Returned the updated access control list.

Settings

Member Visibility

On This Page

Methods