IRPCObjectOperations.CheckAccess
Vault API / core read session or assertion idempotent returns metadata structure version
Checks user's access to an object based on an ACL.
| Service | Objects, versions, properties and files MFiles.IRPCObjectOperations |
|---|---|
| gRPC method | /MFiles.IRPCObjectOperations/CheckAccess |
| HTTP (mf-http-grpc) | POST /grpc/v1/check-access |
| Request | CheckAccessRequest |
| Response | CheckAccessResponse |
| Book and level | Vault API, core |
| Kind | read |
| Session | Required: a session (mfiles-session-id-bin metadata) or a session assertion (x-mf-session-assertion metadata). |
| Idempotent | yes |
| Returns metadata structure version | yes (in the mfiles-metadata-version-bin trailer) |
| Streaming | none (unary) |
Remarks
Evaluates an ACL for the caller without touching any object, for example a named ACL's
acl_for_objects before using it (for example, has_access true for "Full control for all internal
users", false for a named ACL of a group the user is not in).
Request: CheckAccessRequest
Nested message fields are expanded to depth 3; follow a type link for deeper levels and for the type's own page. Fields marked (recursive) refer to a type already on their path.
| Field | Type | Description |
|---|---|---|
acl | AccessControlList | The object's ACL. |
acl.checked_out_to_user | int32 | Specifies the ID of the user who has extended rights because of the checkout operation performed by her. 0 if such user does not exist. |
acl.is_fully_authoritative | bool | Specifies whether this access control list is set to ignore the secondary permissions that come from the latest checked in version. |
acl.custom_component | AccessControlListComponent | Accesses the custom component of this ACL. |
acl.custom_component.named_acl_id | int32 | Specifies the named ACL link of this component. |
acl.custom_component.has_named_acl | bool | True if the component links to a named ACL (named_acl_id). |
acl.custom_component.current_user_id | int32 | Specifies the current user binding of this component. |
acl.custom_component.has_current_user | bool | True if the component has an access control entry for the current user. |
acl.custom_component.permissions[] | repeated AccessControlEntry | The access control entry datas. The data belongs to the key in the corresponding index. |
acl.custom_component.overridability_permissions[] | repeated AccessControlEntry | Overridability permission data of this ACL component. |
acl.custom_component.status | ACCESSCONTROLLISTCOMPONENTSTATUSFLAGS | Modification status of this component. |
acl.restrictive_components[] | repeated AccessControlListComponentMapEntry | Accesses the restrictive automatic components of this ACL. |
acl.restrictive_components[].key | AccessControlListComponentKey | Access control list component. |
acl.restrictive_components[].component | AccessControlListComponent | Access control list component. |
acl.secondary_access_control_list | AccessControlList (recursive) | Secondary ACL used for latest version ACL. Not used for access check if null. |
acl.additive_components[] | repeated AccessControlListComponentMapEntry | Accesses the additive automatic components of this ACL. |
acl.additive_components[].key | AccessControlListComponentKey | Access control list component. |
acl.additive_components[].component | AccessControlListComponent | Access control list component. |
required_access | ObjectAccess | The object-level access requirements that must be fulfilled. |
required_access.all | bool | Specifies all flags set; Including any future flags. |
required_access.read | bool | Read. |
required_access.edit | bool | Edit. |
required_access.change_permissions | bool | Change security settings. |
required_access.delete_object | bool | Delete. |
required_access.attach_objects | bool | Attach objects. |
Response: CheckAccessResponse
Nested message fields are expanded to depth 3; follow a type link for deeper levels and for the type's own page.
| Field | Type | Description |
|---|---|---|
has_access | bool | Receives true if the user has the required access based on the given ACL. |