更新时间:2025-04-01 GMT+08:00

知识库 CodeArts Wiki

Organizations服务中的服务控制策略(Service Control Policy,以下简称SCP)可以使用以下授权项元素设置访问控制策略。

SCP不直接进行授权,只划定权限边界。将SCP绑定到组织单元或者成员账号时,并没有直接对组织单元或成员账号授予操作权限,而是规定了成员账号或组织单元包含的成员账号的授权范围。

本章节介绍组织服务中SCP使用的元素,这些元素包含了操作(Action)、资源(Resource)和条件(Condition)。

如何使用这些元素编辑SCP自定义策略,请参考创建SCP

操作(Action)

操作(Action)即为SCP中支持的授权项。

  • “访问级别”列描述如何对操作进行分类(list、read和write等)。此分类可帮助您了解在SCP中相应操作对应的访问级别。
  • “资源类型”列指每个操作是否支持资源级权限。
    • 资源类型支持通配符号*表示所有。如果此列没有值(-),则必须在SCP语句的Resource元素中指定所有资源类型(“*”)。
    • 如果该列包含资源类型,则必须在具有该操作的语句中指定该资源的URN。
    • 资源类型列中必需资源在表中用星号(*)标识,表示使用此操作必须指定该资源类型。

    关于CloudWiki定义的资源类型的详细信息请参见资源类型(Resource)

  • “条件键”列包括了可以在SCP语句的Condition元素中支持指定的键值。
    • 如果该授权项资源类型列存在值,则表示条件键仅对列举的资源类型生效。
    • 如果该授权项资源类型列没有值(-),则表示条件键对整个授权项生效。
    • 如果此列条件键没有值(-),表示此操作不支持指定条件键。

    关于CloudWiki定义的条件键的详细信息请参见条件(Condition)

您可以在SCP语句的Action元素中指定以下CloudWiki的相关操作。

表1 CloudWiki支持的授权项

授权项

描述

访问级别

资源类型(*为必须)

条件键

cloudwiki::access

授予权限以访问cloudwiki服务。

write

     

CloudWiki的API通常对应着一个或多个授权项。表2展示了API与授权项的关系,以及该API需要依赖的授权项。

表2 API与授权项的关系

API

对应的授权项

依赖的授权项

ApigDeleteFile

cloudwiki::access

-

ExternalDeleteFile

cloudwiki::access

-

DeleteVersionFromFile

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

DeleteFileInfoById

cloudwiki::access

-

BatchLogicDeleteFile

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

DeleteFile

cloudwiki::access

-

ApigDownloadFile

cloudwiki::access

-

ExternalDownloadFile

cloudwiki::access

-

PreviewOrDownloadFile

cloudwiki::access

-

GetDownloadTaskList

cloudwiki::access

-

DownloadTaskById

cloudwiki::access

-

GetDownloadTaskById

cloudwiki::access

-

DownloadFiles

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

DeleteDownloadTask

cloudwiki::access

-

MoveFile

cloudwiki::access

-

MoveFileFolder

cloudwiki::access

-

RenameFolder

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

SortFile

cloudwiki::access

-

ExternalGetSubNodesByBelongId

cloudwiki::access

-

ExternalGetChildrenFile

cloudwiki::access

-

ExternalGetFileList

cloudwiki::access

-

ExternalGetMyFileList

cloudwiki::access

-

ExternalGetAmount

cloudwiki::access

-

ExternalGetPrjList

cloudwiki::access

-

ExternalGetFileInfoByDocId

cloudwiki::access

-

GetFileInfoById

cloudwiki::access

-

GetHotFilesPage

cloudwiki::access

-

GetFileHistoryList

cloudwiki::access

-

GetTreeByNodeId

cloudwiki::access

-

GetChildren

cloudwiki::access

-

SearchFiles

cloudwiki::access

-

GetMyCreateFiles

cloudwiki::access

-

GetDriverFileInfoById

cloudwiki::access

-

GetAssociationList

cloudwiki::access

codeartsreq:workitem:list,codeartsreq:workitem:get

GetSubNodesByBelongId

cloudwiki::access

-

ExternalPreviewFile

cloudwiki::access

-

ExternalGetPreviewUrl

cloudwiki::access

-

GetFilePreViewInfo

cloudwiki::access

-

PreviewFile

cloudwiki::access

-

PreviewObsUrl

cloudwiki::access

-

ObsAuthorizeResource

cloudwiki::access

-

AddTenantInviteFromFile

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

GetInviteListByObjIdFromFile

cloudwiki::access

-

GetShareDocHtmlFromFile

cloudwiki::access

-

AddInviteFromFile

cloudwiki::access

codeartsreq:workitem:list,codeartsreq:workitem:get

GetInviteListByTenantFromFile

cloudwiki::access

-

DeleteInviteFromFile

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

PublicTreeFromFile

cloudwiki::access

-

ShareFile

cloudwiki::access

-

UpdateInvitePermission

cloudwiki::access

-

UpdateVersionNameFromFile

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

RecoverVersionFromFile

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

RenameFile

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

UpdateFileParentPath

cloudwiki::access

-

SaveAssociations

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

DeleteAssociations

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

GetMyFavouriteFiles

cloudwiki::access

-

UploadConvertResult

cloudwiki::access

-

ApigUploadFile

cloudwiki::access

-

ExternalUploadFile

cloudwiki::access

-

ExternalPrjUpload

cloudwiki::access

-

FileStore

cloudwiki::access

-

Save

cloudwiki::access

-

BatchGetPreviewLink

cloudwiki::access

-

SaveUpload

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

Upload

cloudwiki::access

codeartsreq:workitem:list,codeartsreq:workitem:get

ValidateFolder

cloudwiki::access

-

SaveFolder

cloudwiki::access

-

UploadFolder

cloudwiki::access

-

CreateFolder

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

DeleteFileFolder

cloudwiki::access

-

DownloadFileFolder

cloudwiki::access

-

AddAttachment

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

GetAttachments

cloudwiki::access

-

DeepCopyChildren

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

CopyDocument

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

CheckTemplatePermission

cloudwiki::access

-

SaveDoc

cloudwiki::access

-

CreateDocByDocSourceAndRedirectEditPage

cloudwiki::access

-

CreateDocAndRedirectEditPage

cloudwiki::access

-

UploadZipFile

cloudwiki::access

-

LogicDeleteDoc

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

BatchLogicDeleteDoc

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

ConvertAndExport

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

JumpDolphinById

cloudwiki::access

-

BatchDownloadDoc

cloudwiki::access

-

ValidateImportDoc

cloudwiki::access

-

ResolveZipFile

cloudwiki::access

-

ImportDoc

cloudwiki::access

-

MoveDocument

cloudwiki::access

-

RenameDocFolder

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

translateText

cloudwiki::access

codeartsreq:report:list,codeartsreq:report:get

GetReportTree

cloudwiki::access

-

GetAllByTreeId

cloudwiki::access

-

GetVersionContentByContentId

cloudwiki::access

-

GetMyFavouriteDocs

cloudwiki::access

-

DoFavourites4Organization

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

BatchDocFavourites

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

GetDocListTitles

cloudwiki::access

-

GetRecentRecords

cloudwiki::access

-

GetRecentRecordDocs

cloudwiki::access

-

GetTreeByZhiShiKuId

cloudwiki::access

-

GetNodeCountByZhiShiKuId

cloudwiki::access

-

GetTreeAncestors

cloudwiki::access

-

GetSons

cloudwiki::access

-

GetBrothers

cloudwiki::access

-

GetTreeBaseInfo

cloudwiki::access

-

GetWidget

cloudwiki::access

-

GetContentHistoryList

cloudwiki::access

-

SearchDocs

cloudwiki::access

-

GetDocPermission

cloudwiki::access

-

GetMyCreateDocs

cloudwiki::access

-

GetLastCreateParent

cloudwiki::access

-

GetTopDocumentsPage

cloudwiki::access

-

GetDocListByProjectId

cloudwiki::access

-

GetMyCreateDocs4OldWiki

cloudwiki::access

-

RemoveRecentRecords

cloudwiki::access

-

SyncWikiInfo

cloudwiki::access

-

GetInviteListByTenantFromDoc

cloudwiki::access

-

GetShareDocHtmlFromDoc

cloudwiki::access

codeartsreq:report:list,codeartsreq:report:get

DeleteInviteFromDoc

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

AddInviteFromDoc

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

GetInviteListByObjIdFromDoc

cloudwiki::access

-

AddTenantInviteFromDoc

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

AddZhishikuInviteFromDoc

cloudwiki::access

-

UpdateInvitePermissionFromDoc

cloudwiki::access

-

ShareFromDoc

cloudwiki::access

-

PublicTreeFromDoc

cloudwiki::access

-

GetReportData

cloudwiki::access

-

GetRelItemObjects

cloudwiki::access

codeartsreq:workitem:list,codeartsreq:workitem:get

GetRelItems

cloudwiki::access

-

GetEditorAuthToken

cloudwiki::access

-

DeleteWidgetById

cloudwiki::access

-

DeleteVersion

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

DeleteDocItem

cloudwiki::access

-

DeleteTag

cloudwiki::access

-

CreateTag

cloudwiki::access

-

UpdateEditorContent

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

UpdateWidget

cloudwiki::access

-

SaveWidget

cloudwiki::access

-

RecoverVersion

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

UpdateVersionNameFromDoc

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

GetDocJoinTag

cloudwiki::access

-

CreateDocJoinTag

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

DeleteDocJoinByDocId

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

RenameDoc

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

ConvertText

cloudwiki::access

-

CreateTags

cloudwiki::access

-

SaveDocItem

cloudwiki::access

-

AtUser

cloudwiki::access

-

ApplayDocEditPermission

cloudwiki::access

-

DeleteAttachment

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

CreateContent

cloudwiki::access

-

CopyDocFolder

cloudwiki::access

-

CreateDocFolder

cloudwiki::access

-

UpdateExtendAttribute

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

DeleteDocFolder

cloudwiki::access

-

SortDoc

cloudwiki::access

-

GetTags

cloudwiki::access

-

MoveDocFolder

cloudwiki::access

-

CopyMailTemplate

cloudwiki::access

-

SaveMailTemplate

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

GetMailTemplateList

cloudwiki::access

-

GetMailTemplatePage

cloudwiki::access

-

GetSendMailPage

cloudwiki::access

-

UpdateMailTemplate

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

SendMailTemplate

cloudwiki::access

-

DeleteMailTemplate

cloudwiki::access

-

DeleteDomainAdmin

cloudwiki::access

-

DeletePrivateMember

cloudwiki::access

-

DeleteMember

cloudwiki::access

-

GetDomainAdmins

cloudwiki::access

-

GetUserInviteListByTenant

cloudwiki::access

-

GetUsersByTenant4Search

cloudwiki::access

-

IsCurrentUserOrgAdmin

cloudwiki::access

-

GetAllMemberByOrgIdPage

cloudwiki::access

-

GetAllAdminsByOrgId

cloudwiki::access

-

SaveMembers

cloudwiki::access

-

SavePrivateMembers

cloudwiki::access

-

SaveFilePrivateMembers

cloudwiki::access

-

SaveDomainAdmin

cloudwiki::access

-

BatchDeleteOrganization

cloudwiki::access

-

LogicDeleteOrg

cloudwiki::access

-

GetMyFavouriteOrganizations

cloudwiki::access

-

DoFavourites4Wiki

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

GetTreeByOrgId

cloudwiki::access

-

GetAllByOrgId

cloudwiki::access

-

VerifyId

cloudwiki::access

-

GetAllOrganization

cloudwiki::access

-

GetOrgId

cloudwiki::access

-

BatchUpdateOrgByIds

cloudwiki::access

-

BatchRecoverOrg

cloudwiki::access

-

SaveOrganization

cloudwiki::access

-

DeleteGlobalRecycleObjects

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

DeleteFiles

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

DeleteDoc

cloudwiki::access

-

CleanRecycle

cloudwiki::access

-

BatchDeleteTeamZskOrDrive

cloudwiki::access

-

CleanCloudDriveRecycle

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

GetRecycleListByPage

cloudwiki::access

-

GetGlobalRecycleListByPage

cloudwiki::access

-

GetGlobalRecycleDeleters

cloudwiki::access

-

GetGlobalRecycleCreators

cloudwiki::access

-

GetRecyclePage

cloudwiki::access

-

RecoverDoc

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

BatchRecoverZskOrDrive

cloudwiki::access

-

RecoverGlobalRecycleObject

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

Recover

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

CreateRole

cloudwiki::access

-

DeleteRole

cloudwiki::access

-

GetRoleList

cloudwiki::access

-

UpdateRole

cloudwiki::access

-

UpdateMemberRole

cloudwiki::access

-

SavePrivateZhiShiKu

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

CreateTeamZskOrDrive

cloudwiki::access

-

SavePrivateDrive

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

LogicDeletePrivateZhiShiKu

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

BatchLogicDeleteZskOrDrive

cloudwiki::access

-

LogicDeletePrivateDrive

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

UpdateMigrateAllStatus

cloudwiki::access

-

ChangeWorkNO

cloudwiki::access

-

GetPrivateDriveById

cloudwiki::access

-

DoFavourites

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

AddOrCancelThumbs

cloudwiki::access

-

GetZskOrDrivePage

cloudwiki::access

-

MigrateSingle

cloudwiki::access

-

DeleteSingle

cloudwiki::access

-

MigrateIncrement

cloudwiki::access

-

MigrateFile

cloudwiki::access

-

GlobalBatchCancelFavourites

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

BatchFileFavourites

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

GetZhiShiKuById

cloudwiki::access

-

GetProjectZhiShiKu

cloudwiki::access

-

GetZhiShiKuList

cloudwiki::access

-

GetGlobalProjectList

cloudwiki::access

-

GetGlobalZhiShiKuList

cloudwiki::access

-

MigrateProjectById

cloudwiki::access

-

InitProjectMigration

cloudwiki::access

-

InitDomainMigration

cloudwiki::access

-

GetThumbsByObjId

cloudwiki::access

-

CheckTenantNameExists

cloudwiki::access

-

CheckTenantNameAndUserNameExists

cloudwiki::access

-

GetTeamsByPage

cloudwiki::access

-

GetZskDriveStatisticsByOrgId

cloudwiki::access

-

GetTeamRecentRecords

cloudwiki::access

-

GetZskDriveMemberQuantityByOrgId

cloudwiki::access

-

GetMyFavouritesInTeam

cloudwiki::access

-

GetMeAndDescendantsPage

cloudwiki::access

-

FullTextSearch

cloudwiki::access

-

GetUsersByTenant

cloudwiki::access

-

SuggestSearch

cloudwiki::access

-

SearchHistory

cloudwiki::access

-

DeleteHistory

cloudwiki::access

-

GetEspaceGroupList

cloudwiki::access

-

GetEspaceGroupUserList

cloudwiki::access

-

GetPrivilegeList

cloudwiki::access

-

GetModuleList

cloudwiki::access

-

QueryMigrateStatus

cloudwiki::access

-

GetGlobalFavourites

cloudwiki::access

-

GetGlobalFavouriteCreators

cloudwiki::access

-

GetDiscoveryPage

cloudwiki::access

-

GetConfigByKey

cloudwiki::access

-

GetConfigsByType

cloudwiki::access

-

GuideRedirect

cloudwiki::access

-

GetProjectDrive

cloudwiki::access

-

GetDrivePage

cloudwiki::access

-

GetZhiShiKuAmountInfo

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

GetUserAmountInfo

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

GetUpdateAmount

cloudwiki::access

-

GetProjectAmount

cloudwiki::access

-

GetNewAmountInfo

cloudwiki::access

-

CleanHistory

cloudwiki::access

-

RollBack

cloudwiki::access

-

SyncZhishiku

cloudwiki::access

-

ShareZhiShiKu

cloudwiki::access

-

PublicTreeFromWiki

cloudwiki::access

-

UpdateZhishikuInvitePermission

cloudwiki::access

-

PublicPrivateTree

cloudwiki::access

-

ShareZhiShiKu4Driver

cloudwiki::access

-

PublicTreeFromDriver

cloudwiki::access

-

UpdateZhishikuInvitePermission4Driver

cloudwiki::access

-

PublicPrivateTree4Driver

cloudwiki::access

-

AddTenantZhishikuInvite

cloudwiki::access

-

GetZhishikuInviteListByObjId

cloudwiki::access

-

AddZhishikuInvite4Driver

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

AddZhishikuInvite

cloudwiki::access

-

AddTenantZhishikuInvite4Driver

cloudwiki::access

-

GetZhishikuInviteListByObjId4Driver

cloudwiki::access

-

AddZhishikuInvite4Wiki

cloudwiki::access

-

GetZhishikuInviteListByTenant

cloudwiki::access

-

GetShareTree

cloudwiki::access

-

PreviewSharedFileObsUrl

cloudwiki::access

-

GetZhishikuInviteListByTenant4Driver

cloudwiki::access

-

GetShareTree4Driver

cloudwiki::access

-

DeleteZhishikuInvite

cloudwiki::access

-

DeleteZhishikuInvite4Driver

cloudwiki::access

-

UpdateTeamZhiShiKu

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

UpdateTeamZskExtendAttribute

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

UpdatePrivateZhiShiKu

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

UpdatePriviteZskExtendAttribute

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

UpdateTeamDrive

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

UpdatePrivateDrive

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

UpdateProjectSpaceSettings

cloudwiki::access

-

SaveTalkNotes

cloudwiki::access

-

GetTalkNotesPage

cloudwiki::access

-

GetTalkNotesTimes

cloudwiki::access

-

SyncWikiTalknotes

cloudwiki::access

-

DeleteTalkNotes

cloudwiki::access

-

SaveTemplate

cloudwiki::access

-

SaveDocToTemplate

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

DeleteTemplate

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

GetTemplatePage

cloudwiki::access

-

GetTemplateById

cloudwiki::access

-

GetTemplateThumbnail

cloudwiki::access

-

GetTemplateList

cloudwiki::access

-

QueryTemplateCategory

cloudwiki::access

-

SyncTemplate

cloudwiki::access

-

RenameTemplate

cloudwiki::access

codeartsworkspace:project:getCreatorAccountActivationStatus

ExchangeTemplate

cloudwiki::access

-

ChangeTemplateCategory

cloudwiki::access

-

UpdateTemplateCategory

cloudwiki::access

-

UploadPreViewImg

cloudwiki::access

-

SaveTemplateCategory

cloudwiki::access

-

DeleteTemplateCategory

cloudwiki::access

-

资源类型(Resource)

CloudWiki服务不支持在SCP中的资源中指定资源进行权限控制。如需允许访问CloudWiki服务,请在SCP的Resource元素中使用通配符号*,表示SCP将应用到所有资源。

条件(Condition)

CloudWiki服务不支持在SCP中的条件键中配置服务级的条件键。