steedos-object-permissions（Steedos 对象权限）

Steedos Object Permissions | Steedos 对象权限

Overview | 概述

Steedos provides multi-level permission control: object-level, record-level, and field-level. Permissions are defined as separate .permission.yml files in the object's permissions/ subfolder.

Steedos 提供多级别权限控制：对象级、记录级和字段级。权限作为独立的 .permission.yml 文件定义在对象的 permissions/ 子文件夹中。

File Location | 文件位置

steedos-packages/
└── my-package/
    └── main/default/
        ├── objects/
        │   └── orders/
        │       └── permissions/
        │           ├── user.permission.yml
        │           ├── admin.permission.yml
        │           └── sales_manager.permission.yml
        ├── permissionsets/
        │   ├── sales.permissionset.yml
        │   └── finance.permissionset.yml
        ├── profiles/
        │   └── user.profile.yml
        ├── roles/
        │   └── sales_manager.role.yml
        └── restrictionRules/
            └── user_filter.restrictionRule.yml

Object Permission (.permission.yml) | 对象权限

# objects/orders/permissions/user.permission.yml
name: orders.user
permission_set_id: user
allowCreate: true
allowRead: true
allowEdit: true
allowDelete: false
allowExport: true
viewAllRecords: true
modifyAllRecords: false
allowReadFiles: true
allowCreateFiles: true
allowEditFiles: true
allowDeleteFiles: false
viewAllFiles: true
modifyAllFiles: false
field_permissions: []

Permission Properties | 权限属性

Complete Examples | 完整示例

Regular User Permission | 普通用户权限

# objects/orders/permissions/user.permission.yml
name: orders.user
permission_set_id: user
allowCreate: true
allowRead: true
allowEdit: true
allowDelete: false
allowExport: true
viewAllRecords: false
modifyAllRecords: false
allowReadFiles: true
allowCreateFiles: true
allowEditFiles: true
allowDeleteFiles: false
viewAllFiles: false
modifyAllFiles: false
field_permissions: []

Admin Permission | 管理员权限

# objects/orders/permissions/admin.permission.yml
name: orders.admin
permission_set_id: admin
allowCreate: true
allowRead: true
allowEdit: true
allowDelete: true
allowExport: true
viewAllRecords: true
modifyAllRecords: true
allowReadFiles: true
allowCreateFiles: true
allowEditFiles: true
allowDeleteFiles: true
viewAllFiles: true
modifyAllFiles: true
field_permissions: []

Custom Permission with Field Restrictions | 带字段限制的自定义权限

# objects/orders/permissions/customer_service.permission.yml
name: orders.customer_service
permission_set_id: customer_service
allowCreate: true
allowRead: true
allowEdit: true
allowDelete: false
viewAllRecords: true
modifyAllRecords: false
field_permissions:
  - field: profit_margin
    readable: false
    editable: false
  - field: internal_notes
    readable: false
    editable: false

Permission Set (.permissionset.yml) | 权限集

Permission sets group permissions and can be assigned to users:

# permissionsets/sales.permissionset.yml
name: sales
label: Sales Team
type: permission_set
locked: false

# permissionsets/finance.permissionset.yml
name: finance
label: Finance Team
type: permission_set
enable_MFA: false
login_expiration_in_days: 90
locked: false

Profile (.profile.yml) | 简档

Profiles assign applications to user groups:

# profiles/user.profile.yml
name: user
label: Standard User
type: profile
assigned_apps:
  - crm
  - orders
  - projects
max_login_attempts: '0'
lockout_interval: '15'
password_history: '3'

Role (.role.yml) | 角色

# roles/sales_manager.role.yml
name: Sales Manager
api_name: sales_manager
label: Sales Manager
locked: false

Restriction Rules (.restrictionRule.yml) | 限制规则

Restrict record visibility based on user attributes:

# restrictionRules/user_order_filter.restrictionRule.yml
name: user_order_filter
object_name: orders
active: true
entry_criteria: '{{$user.profile == "user"}}'
record_filter: >
  {{[
    ["owner", "=", "$user.userId"],
    "or",
    ["assigned_to", "=", "$user.userId"]
  ]}}

Record-Level Permissions | 记录级权限

Ownership-Based | 基于所有权

# When modifyAllRecords: false, users can only modify their own records
modifyAllRecords: false    # Can only edit own records
viewAllRecords: false      # Can only view own records

Company-Based | 基于公司

viewCompanyRecords: true   # Can view company records
modifyCompanyRecords: true # Can edit company records

Dynamic Permissions with Triggers | 触发器动态权限

For complex permission logic, use triggers:

# triggers/contracts_permission.trigger.yml
name: contracts_permission
listenTo: contracts
when:
  - beforeUpdate
isEnabled: true
type: code
handler: |-
  const { doc, previousDoc } = ctx.params;

  // Only owner or admin can change status
  if (doc.status && doc.status !== previousDoc.status) {
    if (previousDoc.owner !== ctx.userId) {
      const user = await ctx.getUser(ctx.userId, ctx.spaceId);
      if (!user.is_admin) {
        throw new Error('Only contract owner or admin can change status');
      }
    }
  }

  return { doc };

Best Practices | 最佳实践

1. Principle of least privilege: Start with minimal permissions, add as needed
2. Protect sensitive fields: Use field_permissions to hide salary, SSN, etc.
3. Use restriction rules: For row-level security beyond simple ownership
4. Separate permission sets per role: Create distinct permission sets for sales, finance, HR, etc.
5. Always define both user and admin: Every object should have at least these two permission sets