Nuxeo Drive and File Permissions

A few months ago, the Nuxeo Platform LTS 2015 introduced file permissions as a way to restrict access to files in a document. One of the most obvious use case of that feature is Digital Asset Management system as the Nuxeo Platform automatically computes several conversions of picture and video assets for different resolutions and formats.

A Picture Asset

Here is an example. Let’s say that for picture assets, the main file is an Adobe Photoshop file whose access should be restricted only to the creative team while the JPEG conversions should be made available to any consumer user who has access to the asset. File permissions enable us to do that. Now let’s take it one step further and say that all those users should still be able to synchronize assets on their desktop. The creative team user can synchronize the Photoshop files while other users can synchronize the JPEG conversions.

Since Nuxeo Drive, our desktop sync application, synchronises the main file by default, it’s not going to work for users who don’t have the permission to download that file. However, the Nuxeo Platform provides an easy way to implement this use case without modifying Nuxeo Drive. The only thing to do is to override the default BlobHolderFactory class that Nuxeo Drive relies on and replace it by an implementation that includes our business logic.

public class CustomPictureBlobHolderFactory implements BlobHolderFactory {
        BlobHolder blobHolder;
        if (doc.hasFacet("Picture")) {
            NuxeoPrincipal principal = (NuxeoPrincipal) doc.getCoreSession().getPrincipal();
            if (!principal.isMemberOf("Creatives")) {
                blobHolder = new PictureBlobHolder(doc, "picture:views/3/content");
            } else {
                blobHolder = new PictureBlobHolder(doc, "file:content");
            }
        } else {
            blobHolder = null;
        }
        return blobHolder;
}

That’s it. Nuxeo Drive now synchronizes the main file for the creatives and the JPEG conversions for other users.

Asset Folder

PSD files in the local folder of a user who is a member of the Creatives user group

JPEG files in the local folder of other users

The complete source is available in our nuxeo-sandbox github repository. Try it out and let us know what you think!