Forum Discussion

Shivshankar's avatar
7 years ago

Do we have rest api to check if a user has allow grant permission?

Hi,

 

I am looking for rest api/context object to check allow grant permission for "start topic" for a user.

 

Thanks.

4 Replies

  • Shivshankar -

    You can check the permission coreNode.permissions.hasPermission.   

     

    https://freemarker-docs-portal.lithium.com/refer/contextObjects

     

    coreNode.permissions.hasPermission("property")

     You just need to pass the permission name which you want to view. 

    e.g 

    <#if coreNode.permissions.hasPermission("create_thread")>
      <!-- usre has permission to create thread-->
    </#if>

     Here is the list of permission names which you can pass in the content 

    https://community.lithium.com/t5/Roles-and-permissions/Permission-descriptions/ta-p/108801?attachment-id=5879

  • Shivshankar's avatar
    Shivshankar
    Ace
    7 years ago

    We know this context object.

    But the problem is we are unable to detect whether the user has "grant" or "allow-grant" for that permission.

     

  • TariqHussain's avatar
    TariqHussain
    Boss
    7 years ago

    Shivshankar- You can not check this with context object. May I know why do you want to know grant or allow grant?  Allow and Grant permission are only given to administrator role. For all other roles, there are only Deny and Grant. You simply can check the role also. 

     

  • Shivshankar's avatar
    Shivshankar
    Ace
    7 years ago

    TariqHussain

    I will try to explain the situation we are in.

    We  have a button which we want to show on Board page [forum/idea].

    And this button should have logic as follows

    -Should be visible to only those user who have 

    1) permission to post on that Node

    2) But the Node is not read-only.

     

    But if user is Admin

    it should be visible to him always.

     

    so here we are using

    first read-only api to check if board is read-only

    second as the api for read-only is "restadmin" we are checking roles api and checking if user is admin and accordingly display of button is handled.

     

    The drawback with this approach is the role is getting hardcoded, and we do not want this to happen, rather we want everything to handle by permission.

     

    Is there any way to solve this.