Opening a Sharepoint Document in Read-Only Mode

[PJBruen]

Hi, 

I have a PowerApp whereby a case is created and a document is saved to the Sharepoint Document Library and referenced by the case. Whilst the document goes through various stages of approval, it can be viewed and edited by clicking a link to it using the command Launch(First(colSelectedDocuments).'Link to item'). This all works fine!

However, what I would like to be able to do, is when the document has been fully approved, is there a way to change the link so that the document only opens in Read-Only mode?

I've since tried building this in Power Automate, but I get stuck on the first HTTP request;

https://sergeluca.wordpress.com/2018/05/03/assign-unique-permissions-to-a-document-with-the-new-send...

The error I get is:

The expression "lists/getByTitle(‘Documents’)/items(1)/breakroleinheritance(copyRoleAssignments=false,clearSubscopes=true)" is not valid.
clientRequestId: cb961482-17a5-4d40-ae78-893386123126
serviceRequestId: 820a939f-c0ee-2000-70ec-a673bfc63c7a

(I've tried changing the Items parameter to the ID of a document in the list...still no luck.  /items(1)/

Many thanks

Paul

[Pstork1]

There is no way to change the formatting of the link to make it read only.  To do that you have to actually change the item level permissions on the document itself in SharePoint.  That can be done using an HTTP REST call. Or you can try these actions on sharing.

Manage list item and file permissions with Power Automate | Microsoft Docs

[PJBruen]

Hi @Pstork1 , yeah, that's what the link above is trying to do (unless I've misunderstood).

I get an error with the first HTTP request....not sure what I'm doing wrong.

Regards.

[Pstork1]

Take a look at this example.  I think it does a better job of explaining which dynamic content to use in the requests.  

How to manage permissions on a SharePoint List Item using Microsoft Flow – changing Item permissions...

[PJBruen]

@Pstork1 

Hi,

I'm trying to follow some instructions put together by @BenFetters at:  

https://powerusers.microsoft.com/t5/Power-Automate-Community-Blog/Power-Automate-and-SharePoint-Perm...

Ben, I wonder if you are able to assist me here with a Power Automate/Sharepoint question??

What I'm trying to do is call a Power Automate flow from PowerApps that needs to set a specific document in the Document Library to Read Only. The document should still appear in the library, but ideally only editable by "Owners" and only viewable by "Members".

I've attached some screen shots of Sharepoint and the flow I have so far.

This appears to work, but obviously only changes the permissions for the one user, detailed in the "Send an HTTP request to Sharepoint 2" action.

Are you able to advise what I need to do to this flow to make it set the document to Read Only for everyone in the "Member" group? I'm a bit confused as to how to do this!

 

 

Many thanks

Paul.

[Pstork1]

The problem is in the last two http calls.  In one you are retrieving a principal ID by email.  But you need to get the group id not the user's ID.  That requires a different call.  Then feed that id in as the principal id.  Here is a working example.

[PJBruen]

Thanks @Pstork1 

I did change my flow to look at the group, but it never completed and therefore I cancelled it as I wasn't sure I had it right.

Before I change it again and test it, should URI field be changed to "Member" (as per the group names on the first screenshot) or should I use the names in the Advanced Permission Settings? 

[Pstork1 · Accepted solution]

Use the names in the Advanced Permissions Settings.  That will be the name which the group ID can be retrieved with.  If you use another name it will keep retrying for about 10 minutes since it can't find a match. That may be why your first attempt didn't finish.

[PJBruen]

Many thanks for your help @Pstork1 - that seems to work exactly as I need it too.

[PJBruen]

@Pstork1 

Hi - I've been doing some more testing on this application. The manage access process below was working absolutely fine yesterday, but today, only the side of the flow for making a file editable (1073741830) is working. There are no errors....it just doesn't change the access level to Read Only (1073741826), when following the path where the condition is set to "LOCK".

Any ideas why?

Cheers - Paul

[Pstork1]

I assume you are trying to use this like a Toggle.  The problem is that it isn't designed to work that way.  The permissions are assigned to the group by the command.  But assigning the Read Permission doesn't remove the existing Edit permission.  It works the first time through because it removes all permissions except yours when you break inheritance.  But after that each time you run the HTTP command it adds the permission level back in.  So to set ReadOnly its a Two step process.  First you have to remove the Edit permission (if it exists) and then add the Read permission.  You should be able to remove a permission level setting using the following

_api/web/lists/getByTitle('List%20Name')/Items('ItemID')/RoleAssignments/groups/RemoveByLoginName('GroupName')

[PJBruen]

Hi @Pstork1 

Ahh, I see.

I've tried the following, but unfortunately I get errors on this step. As you've kindly got me this far, would you know how I get around this? You're correct though, the Edit Mode vs. Read-Only Mode needs to work slightly like a toggle I guess. It's likely that when the file gets set to read-Only that it stays that way, but there needs to be the facility to undo it, and make the file editable again.

BODY

{

  "status": 400,

  "message": "This operation is not allowed on an object that inherits permissions.\r\nclientRequestId: 5bac034d-7ce6-4565-ac20-2cd5cb0fc12f\r\nserviceRequestId: 54e8949f-5059-2000-70ec-a6836e6895d0",

  "source": "https://nbsuk.sharepoint.com/sites/StressTestingDatastore/_api/web/lists/getByTitle('Documents')/Rol...')",

  "errors": [

    "-1",

    "System.InvalidOperationException"

  ]

}

HEADERS

{

  "Pragma": "no-cache",

  "x-ms-request-id": "54e8949f-5059-2000-70ec-a6836e6895d0",

  "Strict-Transport-Security": "max-age=31536000; includeSubDomains",

  "X-Content-Type-Options": "nosniff",

  "X-Frame-Options": "DENY",

  "Cache-Control": "no-store, no-cache",

  "Set-Cookie": "ARRAffinity=9b2d45c4bd0030f30e7a2a2896b71140eb7d88b49b44e96d4fd45755b575263c;Path=/;HttpOnly;Secure;Domain=sharepointonline-ne.azconn-ne.p.azurewebsites.net,ARRAffinitySameSite=9b2d45c4bd0030f30e7a2a2896b71140eb7d88b49b44e96d4fd45755b575263c;Path=/;HttpOnly;SameSite=None;Secure;Domain=sharepointonline-ne.azconn-ne.p.azurewebsites.net",

  "Timing-Allow-Origin": "*",

  "x-ms-apihub-cached-response": "true",

  "Date": "Mon, 07 Dec 2020 08:36:36 GMT",

  "Content-Length": "491",

  "Content-Type": "application/json",

  "Expires": "-1"

}

Many thanks,

Paul.

[Pstork1]

The error suggests that you are trying to do those steps without breaking security inheritance first.  Any time you are going to set specific permissions you have to be sure that inheritance is turned off.

[PJBruen]

Hi @Pstork1 

Is that not the purpose of this step though, which is running in my flow.....or am I missing something else?

Sorry to keep hassling you. This is the first time I've ever looked at this stuff, and it's a bit foreign to me, so your help is much appreciated.

Regards,

Paul

[Pstork1]

OK, I see the error.  In the first of the two statements that removes the permissions you are doing it at the list level not the item level.  Everything up through role assignments should be the same on both commands.  in your example you are trying to remove permissions from the list and set them on the item.  Both of those need to be at the item level.

[PJBruen]

Hi @Pstork1 

So, these are the 4 HTTP Send Requests I'm making. I've made one change in red, but wasn't sure what to change in the other (sorry, so confused by this). Can you confirm please?

_api/lists/getByTitle('varLISTNAME')/items(varID)/breakroleinheritance(copyRoleAssignments=false,clearSubscopes=true)

_api/web/SiteGroups/getbyname('varPERMISSIONGROUP')

_api/web/lists/getByTitle('varLISTNAME')/items(varID)/RoleAssignments/groups/RemoveByLoginName('varPERMISSIONGROUP')

_api/lists/getByTitle('varLISTNAME')/items(varID)/roleassignments/addroleassignment(principalid='varGroupID',roledefid=1073741826)

[Pstork1]

The change in red is the correct change.  Everything should work if its setup that way.

[PJBruen]

Hi @Pstork1 

Sorry - I still haven't got this quite right.

This is the URI being entered here:

 _api/web/lists/getByTitle('Documents')/items(11441)/RoleAssignments/groups/RemoveByLoginName('Stress Testing Datastore Members')

The error coming back as Bad Gateway (although the flow was still running, but cancelled after a few mins):

Is "RemoveByLoginName" correct as this is the Group name as opposed to an individual?

Sorry again to keep hassling you.

Regards

Paul 

[PJBruen]

@Pstork1 

So, I tried the following:

If I create a new Sharepoint File and run the READ-ONLY process, then the flow errors with the details above.

If I create a new Sharepoint File and run the EDIT process and then the READ-ONLY process, it seems to work fine.

Would this be what you'd expect?

I don't fully understand this, but as long as it works I'm happy I think!

[Pstork1]

Yes, Remove ByLoginName is the right syntax.  But you will get a Bad Gateway error if the Group doesn't have permissions.  If this is the first time through after breaking security inheritance than the group won't have permissions and you will get an error.  But it should work if the group has read permissions because this is the second time adjusting permissions.