This is how we do it at the moment:
- Create a new custom property called CUSTOM_AppHasSheetRestrictions and give it a possible value of "Yes". You can also add "No" but it's not needed. Resource types should be Apps.
- Link the property with each app that has sheet restrictions and use the value "Yes".
- Create a new custom property for each app that has restrictions. Name the properties something like CUSTOM_AppName_AllowedSheets and list each sheet name in the property. So if your app has sheets called Sheet1 and Sheet2, add those values to the property. You can also add "All" as an extra value for admins etc. Resource types should be Users.
- Link the properties with users and select values that correspond to the sheets the user should have access to. Remember to do this per app (=per custom property).
- Change the default Stream security rule to :
(
resource.resourcetype = "App"
and resource.stream.HasPrivilege("read")
)
or ((resource.resourcetype = "App.Object"
and resource.published ="true"
and resource.objectType != "app_appscript"
and resource.objectType != "loadmodel"
and resource.app.stream.HasPrivilege("read")
and resource.app.@CUSTOM_AppHasSheetRestrictions !="Yes"
))
- Create a new security rule for each app with sheet restrictions and name them anything you want. The contents of the rule should be:
(resource.objecttype!="sheet"
and resource.objectType != "app_appscript"
and resource.objectType != "loadmodel")
or
(resource.resourcetype = "App.Object"
and resource.published ="true"
and resource.objectType ="sheet"
and resource.app.stream.HasPrivilege("read")
and resource.app.@CUSTOM_AppHasSheetRestrictions = "Yes"
and resource.app.name = "NAME OF YOUR APP HERE"
and (user.@CUSTOM_AppName_AllowedSheets = resource.name
or
user.@CUSTOM_AppName_AllowedSheets = "All"
))
Hopefully I didn't miss anything. I'm sure there are better ways to do this but it should get you started at least.
-Teemu
