Folder Permissions

How do permissions work?​

All permissions are set on each folder and are not inherited from the parents. In the UI, it will just prefill the parents' permissions. These will then limit access to the documents inside this folder. A user might still read the name and description of the folder as they need to see it if they only have access to one subfolder. Owners and admins can always see all folders but only the documents they were granted access to.

For permissions, you have two options. Either by setting every user or group of it. There are five System Groups where users are automatically added based on their role.

Managing permissions on a single folder

The simplest way of adding/updating permissions on a folder is to set them directly on it. For this, we need a list of user and group ids that we will later use.

query CompanyUsersAndGroups {
  users {
    id
    fullName
    avatar
  }
  groups {
    id
    name
    isSystem
  }
}

If you then have all the needed group and user ids. You currently have to update them in two separate arrays. This behavior works like this while creating and updating a single folder at a time.

{
  // in addition to what we covered in the previous pages
  "permissionsGroups": ["Z3JvdXA6NjMwNjVhYzAzM2RkYmE0MTQ5NzNjNjM0"],
  "permissionsUsers": ["Z3JvdXA6NjMwNjVhYzAzM2RkYmE0MTQ5NzNjNjMy"]
}

Using permissions while creating folders with a template

This topic can be a little more complex than creating a single folder because you can now replace permissions on the subfolders. How the permissions are set only will set the permissions on the root folder of that template. For the subfolders, you need to set permissionsUsersReplacement and/or permissionsGroupsReplacement. If you want to replace a user with, for example, a group, you have to put this into the permissionsUsersReplacement array.

{
  "permissionsGroupsReplacement": [
    {
      "from": "Z3JvdXA6NjMwNjVhYzAzM2RkYmE0MTQ5NzNjNjMy",
      "to": "Z3JvdXA6NjMwNjVhYzAzM2RkYmE0MTQ5NzNjNjM0"
    }
  ]
}

In our app, we give the user the option to replace only those permissions on the root folder.

info

Currently, you only can replace one permission with only one other one. This limitation might change as soon as we simplify the API around setting permissions.

Updating subfolders

We also have the option to update permission on the subfolders when they are already created. There you have two options you can choose from. Either you replace all permissions on the subfolder with the one you set or add those permissions to them. Replacing individual permissions is not supported.

mutation UpdateSubfolderPermissionsAndLabels(
  $folderId: String!
  $permissionsUsers: [String] # list of user ids
  $permissionsGroups: [String] # list of group ids
  $permissionsUpdateMode: UpdateSubfoldersModeEnum # either "ADD" or "REPLACE"
) {
  updateSubfolderPermissionsAndLabels(
    input: {
      folderId: $folderId
      permissionsUsers: $permissionsUsers
      permissionsGroups: $permissionsGroups
      permissionsUpdateMode: $permissionsUpdateMode
    }
  ) {
    folder {
      id
      name
    }
  }
}