Code snippet: What are my effective permissions {globally, to an item}?

  • Article

One of the things we expose through the object model but we don't expose through the command line is querying the effective permissions you have, either for global permissions (for instance, CreateWorkspace) or to a specific item (for instance, Read, PendChange, Checkin, Lock, etc.).  However, it can occasionally be useful for debugging (for instance, when something fails in the UI in the beta and you want a way to check your effective permissions to the item in question), so here's a quick example that will display the effective permissions you have either globally or to a specific item.

Observant readers may notice that the first parameter to both GetEffectiveGlobalPermissions and GetEffectivePermissions is the user to query about, and wonder why I didn't expose that as another optional parameter.  The reason is because in V1 we have the restriction that the user you're querying about has to be you.  If you try the call with a different user, the server will throw you back a soap exception "TF14014: Cannot query effective item or global permissions for other users". As you can imagine, this somewhat limits the effectiveness of the call for usage by administrators that are trying to debug, for instance, a user's problem without being logged in as them or application sharing, so hopefully it's something we can address in V2.

To build, you'll need to have references to Microsoft.TeamFoundation.Client.dll and Microsoft.TeamFoundation.VersionControl.Client.dll (which you could probably guess from the using statements).

C:\>ShowEffectivePerms.exe jmanning-test
Global permissions for NORTHAMERICA\jmanning: CreateWorkspace, AdminWorkspaces, AdminShelvesets, AdminConnections, AdminConfiguration

C:\>ShowEffectivePerms.exe jmanning-test $/project
Permissions for NORTHAMERICA\jmanning to item $/project: Read, PendChange, Checkin, Label, Lock, ReviseOther, UnlockOther, UndoOther, LabelOther, AdminProjectRights, CheckinOther

 using System;
using Microsoft.TeamFoundation.Client;
using Microsoft.TeamFoundation.VersionControl.Client;

namespace ShowEffectivePerms
{
    class Program
    {
        static void Main(string[] args)
        {
            if (args.Length < 1 || args.Length > 2 || args[0] == "/?" || args[0] == "-?")
            {
                Usage();
                Environment.Exit(1);
            }

            TeamFoundationServer tfs = TeamFoundationServerFactory.GetServer(args[0]);
            VersionControlServer vcs = (VersionControlServer)tfs.GetService(typeof(VersionControlServer));

            string user = vcs.AuthenticatedUser;
            string[] permissions;
            if (args.Length == 1)
            {
                permissions = vcs.GetEffectiveGlobalPermissions(user);
                Console.Write("Global permissions for {0}: ", user);
            }
            else // args.Length == 2
            {
                permissions = vcs.GetEffectivePermissions(user, args[1]);
                Console.Write("Permissions for {0} to item {1}: ", user, args[1]);
            }
            Console.WriteLine(String.Join(", ", permissions));
        }

        private static void Usage()
        {
            Console.Error.WriteLine("Copyright (c) Microsoft Corporation");
            Console.Error.WriteLine("");
            Console.Error.WriteLine("ShowEffectivePerms <server> [$/server/item]");
        }
    }
}

Comments