- name
- nocobase-app-plugin-authz-restriction-rules
- description
- Design, implement and verify restriction rules for NocoBase 3 business operations, including named data scopes and production administration.
Develop restriction rules
A restriction rule intersects the records an action reaches with the rule's selection, for the subjects it lists. The selection describes the records still allowed, not the records to hide. Several matching restrictions all apply; none can grant an action or widen a range.
Read the installed nocobase-app-plugin-authorization Skill first for composite resources, data scopes, fields, server policy enforcement and inherited subjects. The package README at node_modules/@nocobase/app-plugin-authz-restriction-rules/README.md is the complete reference for the service, the HTTP routes and the exports; this Skill covers how to use them.
For a restriction assigned to a department, or to the root department for the whole company, read the application development Skill's references/organization/permission-design.md first. Its core works with permission sets alone and says how to keep excluded records out without this plugin; its optional restriction section covers this one.
Development workflow
- State the invariant positively, for example "this team may access only non-confidential projects". Define who it applies to and whether it covers one operation or every path to a collection.
- Use a rule on a composite, with
scopeKey, for an operation-specific limit. For a limit across every business branch, create a rule on thedatabase.collectionwith its CRUD actions; declared business data scopes and collection-wide invariants are both provisioned through the HTTP routes or the service. - Register a suitable record access and save the complete rule. Apply the restriction directly to a user as well when it must remain after that person's team membership is removed.
- Bind policies on all protected reads and writes. For relation targets, declare relation record access explicitly; a standalone collection restriction is not inherited by nested relation writes.
- Verify the excluded row stays inaccessible after adding broad sharing and another permission set, across each protected operation, and that unrelated actors keep their intended access.
For example, a confidentiality restriction assigned directly to each account holds whichever permission set grants the action. Test with ordinary users: unrestricted identities skip every rule.
Install
Register the default export of @nocobase/app-plugin-authz-restriction-rules/client in client/plugins.ts and of @nocobase/app-plugin-authz-restriction-rules/server in , beside the main authorization plugin, and run the application's migrations. Add the factory to the of , merged with the application's other rule factories: