This topic provides guidance and examples for using the JavaScript Security API. Getting, updating, and saving the
Security Policy for your container lets you programmatically set and change user permissions.
Example 1
- Create a security group (here named 'New Group Name')
- Add members to that group
- Get, update, and set the revised security policy
<script>
var groupId;
var userId = LABKEY.user.id;
// Create a new group
LABKEY.Security.createGroup({
groupName: 'New Group Name',
successCallback: addToGroup
});
// Add current user to the new group
function addToGroup(group)
{
groupId = group.id;
LABKEY.Security.addGroupMembers({
groupId: groupId,
principalIds: userId,
successCallback: getPolicyAndUpdate
});
}
// Get the current folder's security policy
function getPolicyAndUpdate(addedMembers)
{
LABKEY.Security.getPolicy({
resourceId: LABKEY.container.id,
successCallback: updatePolicy
});
}
// Update the security policy, granting the Project Administrator role to the new group
function updatePolicy(policy)
{
policy.assignments.push({role: 'org.labkey.api.security.roles.ProjectAdminRole', userId: groupId});
LABKEY.Security.savePolicy({
policy: policy,
successCallback: nextSteps
});
}
function nextSteps(response)
{
alert('Done!');
}
</script>
Example 2
- Create a new subfolder
- Create project groups
- Assign users to project groups
- Assign permission roles to project groups
In this example, change the GROUP_NAME constant to be the name of the group you're working with. Also change ROLE to the
specific role you want to be using.
const GROUP_NAME = "Group1";
const ROLE = "org.labkey.api.security.roles.FolderAdminRole";
// const PATH = "";
LABKEY.Security.getGroupPermissions({
// containerPath: path,
success: (r) => {
console.log("success1", r);
const resourceId = r.container.id;
const groupId = r.container.groups.find(group => group.name === GROUP_NAME).id;
LABKEY.Security.getPolicy({
// containerPath: path,
resourceId: resourceId,
success: (policy, relevantRoles) => {
policy.assignments.push({role: ROLE, userId: groupId})
LABKEY.Security.savePolicy({
// containerPath: path,
policy: {policy},
success: (r) => {console.log("success2", r)},
failure: (r) => {console.log("failure2", r)}
});
}
});
},
failure: (r) => {console.log("failure1", r)}
});
Get a List of Available Roles
In order to see a list of roles available, execute:
LABKEY.Security.getRoles({success: (r) => console.log("roles", r)})and take a look at the 'uniqueName' properties.
Container Path
The JavaScript Security API will default to using the container path that they are executed in. If you want to use another container you can explicitly pass in the containerPath, as shown in comments in
example 2.
Update Folder to Inherit Permissions
If you want to use the JavaScript API to change a folder from having it's own permissions configuration to inheriting from the parent container, simply delete the existing policy.
LABKEY.Security.deletePolicy deletes the security policy for the requested resource id. This will cause resource to inherit its security policy from its parent resource.
Troubleshooting
A helpful tip for debugging generally is to include console.logs in the script to provide some visual feedback, as shown in
example two above.
Folder Templates
If you are using the security API to customize the security policy as part of creating a new folder from a template, be sure that you do not also have the following folder objects included. These would overwrite the new policy you customized:
- "Project-level groups and members"
- "Role assignments for users and groups"
Related Topics
