Content Management Interoperability Services (CMIS) Version 1.1

epositorydetermined indicates that the repository has its own mechanism of computing how changing
an ACL for an object influences the non-direct ACEs of other objects.
PermissionDefinition repositoryPermissions A list of names and descriptions of the supported
permissions.
PermissionMapping mappings Contains a list of basic CMIS permissions to allowable actions
mapping.
2.1.12.3.1 Supported Permissions
The list of permission definitions returned by the getRepositoryInfo service lists all the permissions a
repository supports. This list also includes the CMIS permissions if supported by the repository.
A PermissionDefinition holds:
String permission The (technical) name of the permission. Permission names MUST be unique within the
permission definition list.
String description An optional description of the permission that SHOULD be used as the permission's
name to be presented to the user.
2.1.12.3.2 AllowableActions and Permission Mapping
CMIS provides a mechanism called Allowable Actions which allows an application to discover the set of
service operations that can currently be performed on a particular object by the current user, without having
to actually invoke the service.
The set of allowable actions on an object at a point in time are affected not only by CMIS ACLs, but also by
other factors such as:
• Constraints inherent in the CMIS Domain Model based on the object's base type or current versioning
state.
• Policies or other control mechanisms that are opaque to CMIS.
CMIS defines several services that applications can use at run-time to discover the allowable actions for an
object.
If a repository supports ACLs, then the repository MUST provide a mapping table that defines how the
permissions supported by the repository interact with the CMIS allowable actions, i.e. which permissions
are necessary for a principal to have on one or more objects in order to potentially perform each action,
subject to the other constraints on allowable actions mentioned above.
This section defines both the allowable actions as well as how those actions are presented in the permission
mapping table.
The permission mapping table contains a set of key--permissions pairs:
String key Since several allowable actions require permissions on more than one object, the mapping table
is defined in terms of permission "keys". (For example, moving a document from one folder to another
may require permissions on the document and each of the folders.) Each key combines the name of
the allowable action and the object for which the principal needs the required permission.
For example, the canMoveObject.Source key indicates the permissions that the principal must
have on the "source folder" to move an object from that folder into another folder.
String permissions The name of one or more permissions that the principal MUST have. If more
than one permission is specified, then the principal MUST be allowed to perform the operation if they
have ANY of the listed permissions.
The following list defines all mapping keys, as well as a permissions mapping that repositories SHOULD
use. Repositories MAY require additional permissions.
CMIS-v1.1-csprd01
Standards Track Work Product
Copyright © OASIS Open 2012. All Rights Reserved.
18 August 2012
Page 86 of 331