- name
- nocobase-app-plugin-authz-default-access
- description
- Design, implement and verify default access for NocoBase 3 business operations, including named data scopes and production administration.
Develop default access
Default access adds a shared record baseline for every identity that already holds an action. It does not grant the action, page access or additional fields. A baseline combines with permission-set data scopes and sharing, and restriction rules still narrow the result, so choose it as an intentional minimum range rather than a fallback for identities without a scope of their own.
Read the installed nocobase-app-plugin-authorization Skill first for composite resources, data scopes, fields, server policy enforcement and inherited subjects. The package README at node_modules/@nocobase/app-plugin-authz-default-access/README.md is the complete reference for the service, the HTTP routes and the exports; this Skill covers how to use them.
For a department-scoped baseline, read the application development Skill's references/organization/permission-design.md first. Its core works with permission sets alone, and its optional default-access section explains why a global default suits a department scope only when everyone holding the action belongs to a department.
Development workflow
- Identify which records every holder of a particular operation should receive by default. A read baseline can be broad while edit remains preparer-only; do not copy read defaults into write operations.
- Confirm the composite, action and data scope exist and that the scope's grants target the intended collection. Reuse an applicable record access or define one through the main authorization Skill.
- Save one rule per resource under a stable
key; a second rule on the same resource is rejected, so extend the existing rule instead. A rule lists every action and data scope it widens; updating it replaces the whole rule, and deleting it removes the baseline, not the permission-set action. - Verify a holder receives the baseline, a person without the action remains denied, and restrictions still remove excluded rows. Also verify an explicit narrow data scope is not unexpectedly broadened by a permissive default.
For example, a quote view baseline can follow related-project ownership while editing follows the preparer, and a job's permission set can separately grant broad viewing that confidentiality restrictions narrow. A project's owner is not necessarily the author of every quote on that project.
Install
Register the default export of @nocobase/app-plugin-authz-default-access/client in client/plugins.ts and of @nocobase/app-plugin-authz-default-access/server in , beside the main authorization plugin, and run the application's migrations. Add the factory to the of , merged with the application's other rule factories: