- name
- nocobase-app-plugin-authz-sharing-rules
- description
- Design, implement and verify sharing rules for NocoBase 3 business operations, including named data scopes and production administration.
Develop sharing rules
A sharing rule adds selected records, or a record access selection, for the subjects it lists, provided they already hold the action. Sharing does not grant the operation, fields, page access or related records, and it cannot select all records. Grants, default access and sharing combine first; restriction rules then narrow the result.
Read the installed nocobase-app-plugin-authorization Skill first for composite resources, data scopes, fields, server policy enforcement and inherited subjects. The package README at node_modules/@nocobase/app-plugin-authz-sharing-rules/README.md is the complete reference for the service, the HTTP routes and the exports; this Skill covers how to use them.
For sharing between departments, read the application development Skill's references/organization/permission-design.md first. A rule whose recipient is a department shares specific records with it; a viewer-relative department scope such as 本部门及下属部门 is computed for the viewer and cannot select another department's records. The guide's optional sharing section covers this plugin, and its core section says what remains with permission sets alone.
Development workflow
- Identify the real collaboration exception: who receives which records, for which actions, and why. Use explicit records for one handover; use a record access selection for a maintained region or team rule.
- Grant the recipients the business action through a permission set first. Register inherited subjects and their active membership resolver through the main authorization Skill.
- Inspect every data scope the operation requires. Quote submission needs the selected quote and its actual parent project. Add each action and data scope deliberately; view, edit and submit are different permissions.
- Save a complete rule through the HTTP routes or the service. Keep record ids tied to their data scope's collection and preserve the other entries on update.
- Verify the handover works, an unshared parent still blocks the workflow, restrictions still exclude confidential records, and sharing alone cannot activate a missing operation.
- Revoke the recipient or the team's permission set and verify the next request loses only that source. Independent direct-user sharing and direct assignments must survive.
For example, a quote handover shares quote edit and submit plus the parent project's submit scope with a delegated engineer. Use the real record ids, never sample ones.
Install
Register the default export of @nocobase/app-plugin-authz-sharing-rules/client in and of in , beside the main authorization plugin, and run the application's migrations. Add the factory to the of , merged with the application's other rule factories: