Permission Control

import type { IPermissionPoint } from '@univerjs/core'import { IPermissionService, PermissionStatus } from '@univerjs/core'import { UnitAction, UnitObject } from '@univerjs/protocol'export class CustomPermissionPoint implements IPermissionPoint {  type = UnitObject.Unkonwn // your type  subType = UnitAction.View // your subType  status = PermissionStatus.INIT  value = true // Default value  id: string  constructor(unitId: string, subUnitId: string, customId: string) {    // The id must be unique within `IPermissionService`.    this.id = `${unitId}.${subUnitId}.${customId}`  }}class YourService {  constructor(@IPermissionService private _permissionService: IPermissionService) {    this._init()  }  _init() {    this._permissionService.addPermissionPoint(new CustomPermissionPoint('unitId', 'subUnitId', 'my-id'))  }}// How to use it elsewhereclass ConsumeService {  constructor(@IPermissionService private _permissionService: IPermissionService) {  }  doSomething() {    const point = this._permissionService.getPermissionPoint(new CustomPermissionPoint('unitId', 'subUnitId', 'my-id').id)    console.log(point.value)  }  bindEvent() {    // This returns an RxJS observable that lets you listen for permission changes    const point$ = this._permissionService.getPermissionPoint$(new CustomPermissionPoint('unitId', 'subUnitId', 'my-id').id)    console.log(point$)  }}

import type { Injector } from '@univerjs/core'import type { IActionInfo, IAllowedRequest, IBatchAllowedResponse, ICollaborator, ICreateRequest, ICreateRequest_SelectRangeObject, IListPermPointRequest, IPermissionPoint, IPutCollaboratorsRequest, IUnitRoleKV, IUpdatePermPointRequest } from '@univerjs/protocol'import { createDefaultUser, generateRandomId, IAuthzIoService, Inject, IResourceManagerService, isDevRole, Univer, UserManagerService } from '@univerjs/core'import { ObjectScope, UnitAction, UnitObject, UnitRole, UniverType } from '@univerjs/protocol'class YourAuthzService implements IAuthzIoService {  private _permissionMap: Map<string, ICreateRequest_SelectRangeObject & { objectType: UnitObject }> = new Map([])  constructor(    @IResourceManagerService private _resourceManagerService: IResourceManagerService,    @Inject(UserManagerService) private _userManagerService: UserManagerService,  ) {    this._initSnapshot()    this._initDefaultUser()  }  private _initDefaultUser() {    const currentUser = this._userManagerService.getCurrentUser()    const currentUserIsValid = currentUser && currentUser.userID    if (!currentUserIsValid) {      this._userManagerService.setCurrentUser(createDefaultUser(UnitRole.Owner))    }  }  private _getRole(type: UnitRole) {    const user = this._userManagerService.getCurrentUser()    if (!user) {      return false    }    return isDevRole(user.userID, type)  }  private _initSnapshot() {    this._resourceManagerService.registerPluginResource({      toJson: (_unitId: string) => {        const obj = [...this._permissionMap.keys()].reduce((r, k) => {          const v = this._permissionMap.get(k)          r[k] = v!          return r        }, {} as Record<string, ICreateRequest_SelectRangeObject & { objectType: UnitObject }>)        return JSON.stringify(obj)      },      parseJson: (json: string) => {        return JSON.parse(json)      },      pluginName: 'SHEET_AuthzIoMockService_PLUGIN',      businesses: [UniverType.UNIVER_SHEET, UniverType.UNIVER_DOC, UniverType.UNIVER_SLIDE],      onLoad: (_unitId, resource) => {        for (const key in resource) {          this._permissionMap.set(key, resource[key])        }      },      onUnLoad: () => {        this._permissionMap.clear()      },    })  }  async create(config: ICreateRequest): Promise<string> {    const permissionId = generateRandomId(8)    if (config.objectType === UnitObject.SelectRange && config.selectRangeObject) {      this._permissionMap.set(permissionId, { ...config.selectRangeObject, objectType: config.objectType })    }    return permissionId  }  async batchAllowed(config: IAllowedRequest[]): Promise<IBatchAllowedResponse['objectActions']> {    const selectionRangeConfig = config.filter(c => c.objectType === UnitObject.SelectRange)    if (selectionRangeConfig.length) {      const currentUser = this._userManagerService.getCurrentUser()      const res = [] as IBatchAllowedResponse['objectActions']      selectionRangeConfig.forEach((c) => {        res.push({          unitID: c.unitID,          objectID: c.objectID,          actions: c.actions.map((action) => {            if (isDevRole(currentUser.userID, UnitRole.Owner)) {              return { action, allowed: true }            }            return { action, allowed: false }          }),        })      })      return res    }    return Promise.resolve([])  }  async list(config: IListPermPointRequest): Promise <IPermissionPoint[]> {    const result: IPermissionPoint[] = []    config.objectIDs.forEach((objectID) => {      const rule = this._permissionMap.get(objectID)      if (rule) {        const item = {          objectID,          unitID: config.unitID,          objectType: rule!.objectType,          name: rule!.name,          shareOn: false,          shareRole: UnitRole.Owner,          shareScope: -1,          scope: {            read: ObjectScope.AllCollaborator,            edit: ObjectScope.AllCollaborator,          },          creator: createDefaultUser(UnitRole.Owner),          strategies: [            {              action: UnitAction.View,              role: UnitRole.Owner,            },            {              action: UnitAction.Edit,              role: UnitRole.Owner,            },          ],          actions: config.actions.map((a) => {            return { action: a, allowed: this._getRole(UnitRole.Owner) }          }),        }        result.push(item)      }    })    return result  }  async listCollaborators(): Promise<ICollaborator[]> {    // List the existing collaborators    return []  }  async allowed(_config: IAllowedRequest): Promise<IActionInfo[]> {    // Because this is a mockService for handling permissions, we will not write real logic in it. We will only return an empty array to ensure that the permissions originally set by the user are not modified.    // If you want to achieve persistence of permissions, you can modify the logic here.    return Promise.resolve([])  }  async listRoles(): Promise<{ roles: IUnitRoleKV[], actions: UnitAction[] }> {    return {      roles: [],      actions: [],    }  }  async update(config: IUpdatePermPointRequest): Promise<void> {    // Update bit information  }  async updateCollaborator(): Promise<void> {    // Update collaborator information    return undefined  }  async createCollaborator(): Promise<void> {    // Create new collaborator information    return undefined  }  async deleteCollaborator(): Promise<void> {    return undefined  }  async putCollaborators(config: IPutCollaboratorsRequest): Promise<void> {    return undefined  }}export class YourPlugin extends Plugin {  constructor(    _config: unknown,    @Inject(Injector) protected override _injector: Injector,  ) {  }  override onStarting(): void {    this._injector.add([IAuthzIoService, { useClass: YourAuthzService }])  }}// By setting the override option to [[IAuthzIoService, null]], you can instruct Univer not to register the built-in IAuthzIoService.// This way, Univer will use the service provided by YourAuthzService as the implementation of the authorization service.const univer = new Univer({  override: [[IAuthzIoService, null]],})univer.registerPlugin(YourPlugin)

const fWorkbook = univerAPI.getActiveWorkbook()const fWorksheet = fWorkbook.getActiveSheet()const worksheetPermission = fWorksheet.getWorksheetPermission()// To set permission points, you must first protect the worksheetawait worksheetPermission.protect()// Set to editable modeawait worksheetPermission.setMode('editable')// Set to read-only modeawait worksheetPermission.setMode('readOnly')// Set to filter/sort only modeawait worksheetPermission.setMode('filterOnly')// Apply a custom configurationawait worksheetPermission.applyConfig({  mode: 'readOnly',  points: {    [univerAPI.Enum.WorksheetPermissionPoint.InsertRow]: true,    [univerAPI.Enum.WorksheetPermissionPoint.InsertColumn]: true,  },})

const fWorkbook = univerAPI.getActiveWorkbook()const fWorksheet = fWorkbook.getActiveSheet()const worksheetPermission = fWorksheet.getWorksheetPermission()// Protect two ranges: A1:B2 is viewable by everyone but not editable,// while C3:D4 is editable only by specified users and hidden from othersconst rules = await worksheetPermission.protectRanges([  {    ranges: [fWorksheet.getRange('A1:B2')],    options: { name: 'Protected Area 1', allowViewByOthers: true },  },  {    ranges: [fWorksheet.getRange('C3:D4')],    options: { name: 'Protected Area 2', allowViewByOthers: false, allowedUsers: ['user1'] },  },])console.log(rules)// List all protection rules on the worksheetconst rules = await worksheetPermission.listRangeProtectionRules()console.log(rules)// Delete the first ruleawait worksheetPermission.unprotectRules([rules[0].id])// Or delete a rule via `FRangeProtectionRule.remove()`await ruleList[0].remove()

const fWorkbook = univerAPI.getActiveWorkbook()const fWorksheet = fWorkbook.getActiveSheet()const fRange = fWorksheet.getRange('A1:B2')const rangePermission = fRange.getRangePermission()// Protect the range so only specified users can edit it, while others cannot view itconst rule = await rangePermission.protect({  name: 'My protected range',  allowViewByOthers: false,  allowedUsers: ['user1', 'user2'],})console.log(rule)// List all protection rules covering the rangeconst rules = await rangePermission.listRules()console.log(rules)// Delete all protection rules covering the rangeawait rangePermission.unprotect()// Or delete a rule via `FRangeProtectionRule.remove()`await rules[0].remove()

const fWorkbook = univerAPI.getActiveWorkbook()const fWorksheet = fWorkbook.getActiveSheet()const fRange = fWorksheet.getRange('A1:B2')const rangePermission = fRange.getRangePermission()// To set permission points, you must first create a range protection ruleif (rangePermission.isProtected()) {  const rules = await rangePermission.listRules()  // Disable editing but enable viewing for the first protection rule  await rules[0].setPoint(univerAPI.Enum.RangePermissionPoint.Edit, false)  await rules[0].setPoint(univerAPI.Enum.RangePermissionPoint.View, true)} else {  const rule = await rangePermission.protect({    name: 'My protected range',    allowViewByOthers: false,    allowedUsers: ['user1', 'user2'],  })  // Disable editing but enable viewing for the A1:B2 range  await rule.setPoint(univerAPI.Enum.RangePermissionPoint.Edit, false)  await rule.setPoint(univerAPI.Enum.RangePermissionPoint.View, true)}