# Task OP-13884 - Investigate Permission handling over Sharepoint/OneDrive API

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-13884

## Details

| Attribute | Value |
| --- | --- |
| Assignee | Marcello Rocha Pereira |
| Date | 2023-12-11 –  |
| Priority | Medium |
| Target versions | 13.3.0 |
| Category |  |
| Labels |  |

## Description

First of all we need to understand what MS calls `Permissions` over their API, to quote them:

> The **Permission** resource provides information about a sharing permission granted for a [DriveItem](https://learn.microsoft.com/en-us/graph/api/resources/driveitem?view=graph-rest-1.0) resource.
> 
> Sharing permissions have many different forms. The **permission** resource represents these different forms through facets on the resource.

Sharing Permissions can be one of: `read`, `write` or `owner`. While those gives "access" to the file/folder it isn't exactly access control, as someone who has access to the relevant `Document Library` (i.e. `drive resource`) can see the folder/file normally.

Actual user access control is made thru Sharepoint Site Group, and that's site wide. It is possible to make make folders not inherit the site permissions but this implies steps to be taken by the Sharepoint Admin.

In order to make a Folder/Document Library not inherit the permissions Site Admin action is required in order to make it so, and it isn't considered a good practice as this creates "granular permissions" a increase the burden on admins.

We can add/remove users to the Site group, the application would need a `GroupMember.ReadWrite.All` and `User.ReadWrite.All`. These application permissions would apply to the whole tenant and all `Groups`. (**Note:** It is worth of noting that there's a possibility of synchronization with a on premises Active Directory)

Note that we can't (as in there's no API at all for):  
1\. Create a Site  
2\. Edit the ACL for folders or Document Libraries in order to make then not inherit the permissions.  
3\. Probably other details :P