Permissions

Make a whole Base or individual tables, fields, records, and views read-only. Use this for reports or to allow edits to only part of the data.

Register the Bases plugin and import @univerjs-pro/bases/facade before using these APIs.

Make a Base read-only

const base = univerAPI.getActiveBase()if (!base) throw new Error('Open a Base first')await base.getPermission().setReadOnly()console.log(base.getPermission().canEdit()) // falseawait base.getPermission().setEditable()

Restrict an individual object

For example, restrict one table:

const table = base.getTables()[0]if (!table) throw new Error('Create a table first')await table.getPermission().setReadOnly()await table.getPermission().setEditable()

Fields, records, and views also expose getPermission(), as do dashboards and pivot views when their plugin is registered. Enabling an object does not override a parent restriction: making a record editable cannot override a read-only table.

setReadOnly() and setEditable() return promises and require await. Use base.getPermission().setObjectPermissions() for batched changes; see Bases Facade for parameters.

Copy, export, and comments

Base-level permissions also control copying, exporting, and commenting. For example, disable copying:

import { UnitAction } from '@univerjs/protocol'await base.getPermission().setPoint(UnitAction.Copy, false)

Use UnitAction.Export and UnitAction.Comment for export and comment permissions.

Connect business permissions

Local permissions control editor behavior. Collaborative applications must also authorize content reads, joining collaboration, and submitting changes on the server; see server integration.

Test with an editor, viewer, and unauthorized user, checking both page actions and direct requests.