Document service and Document access

[henk_stobbe]

Hello All!

Easy question, from below permissions:

-Grants permission to read documents of the document service document:documents:read

-Grants permission to read environment shares of the document service document:environment-shares:read

-Grants permission to read direct shares of the document service document:direct-shares:read

Does this means that these are 3 different kinds of entities and does ":documents:" mean my-documents and public documents?

KR Henk

[henk_stobbe]

Tested all options,

Looks like "document:documents:read" is to make it possible to read all your owned/to you assigned/public documents

The other two are more so you can create an environment share or direct share. (Little confusing if you ask me)-;

KR Henk

[haris · Accepted solution]

Hi Henk,

the info that explains the concept regarding it (which makes permission more understandable in context of documents) is here: https://developer.dynatrace.com/plan/platform-services/document-service/

For the permissions: 

document:documents:read

Grants permission to read documents of the document service 

document:environment-shares:read

Grants permission to read environment shares of the document service

document:direct-shares:read

Grants permission to read direct shares of the document service

this basically translates into 3 tier permissions, which reflect this concept here:

Sharing documents​

Users can share the document with other users. The document owner can grant either read-only or read-write access to the document for other users. Document service also prevents accidental overwriting due to collaboration using optimistic locking

There are three ways a user can share documents:

• Public: A document's owner can grant read-only access to the document to all users of the same environment.
• Environment: A document's owner can grant access to the document to all users of the same environment. Each user must opt in individually.
• Direct: A document's owner can grant specific users or groups access to a document.
  
  

So to summarize, 

document:documents:read is for the public documents, and the other two are for environment and direct shared documents as you mentioned yourself above.

What is the biggest confusion, or what would resolve the confusion for you? 

[henk_stobbe]

Hallo Haris,

Thanks for your reply!

I have tested above, but it seems that the documentation seems incorrect.

document:environment-shares

Grants permission to read environment shares of the document service => looks more like the privilege to create an environment share, and to list your create environment shares 

document:direct-shares

Grants permission to read direct shares of the document service => Seems more that this is about the privilege to be able to create a share or list your shared shares

Without: 

document:documents:read

There are absolute no documents you can see, 

KR Henk

As always, I could be wrong  (-;

[haris]

Thank you Henk, I've forwarded your feedback to our team. 

[haris · Accepted solution]

Hi Henk, I've had a chat with our team, and here's some information regarding what we've discussed above:

So to summarize,
document:documents:read is for the public documents, and the other two are for environment and direct shared documents as you mentioned yourself above.

This is incorrect. This permission is for reading documents, regardless of whether they're owned by you, shared with you, or public. This is the basic requirement to access any document.

document:environment-shares
Grants permission to read environment shares of the document service => looks more like the privilege to create an environment share, and to list your create environment shares
document:direct-shares
Grants permission to read direct shares of the document service => Seems more that this is about the privilege to be able to create a share or list your shared shares

This is also incorrect - document:environment-shares is not a permission, it's the target of a permission. It's only a permission when you add a verb at the end - e.g. :read or :write .So, the correct info is:

• you need document:documents:read to access documents in general. with this, you'll be able to see your own documents, public documents, and documents that other people have shared with you
• you need document:environment-shares:claim to consume link-shares
• you need all the document:environment-shares:... and document:direct-shares:... permissions to create and maintain shares of documents you own

All this information can not be found in the devportal, but can be found on the swagger UI or in the generated SDK's documentation. 

Hope it helps, if not, let me know if I can do anything else on this matter.
Best, Haris

[henk_stobbe]

Hello Haris,

Thanks for going the extra mile (-; Great explanation thanks!

KR Henk