Permission Matches

Permission Matches

• Python Regular Expressions
• Definitions

Definitions

::= --(|T)::. | (+|-)(m|h|d|w|y) | never| now|today ::= commenter| contentmanager|fileorganizer| contributor|editor|writer| manager|organizer|owner| reader|viewer ::= anyone|domain|group|user

In the print/show filecounts/filelists/filetree commands you can limit the files counted/displayed by specifying permissions that the file must/must not have.

Permission matching is expensive on Team Drives as retrieving the permissions requires a separate API call per file.

<PermissionMatch> ::=
        permissionmatch|pm [not]
            [type <DriveFileACLType>] [role <DriveFileACLRole>]
            [allowfilediscovery|withlink <Boolean>]
            [emailaddress <RegularExpression>] [domain <RegularExpression>]
            [name|displayname <RegularExpression>]
            [expirationstart <Time>] [expirationend <Time>]
            [deleted <Boolean>]
        endmatch|em
<PermissionMatchMode> ::=
        permissionmatchmode|pmm or|and
<PermissionMatchAction> ::=
        permissionmatchaction|pma process|skip

You can define multiple permission matches; each match specifies a set of required fields/values. By default, a permission matches if all of its fields/values match the required fields/values. You can negate the match with not.

• permissionmatch - Start of permission match definition.

• not - Negate the match.

• type <DriveFileACLType> - The type of the grantee.

• role <DriveFileACLRole> - The role granted by this permission.

• allowfilediscovery|withlink <Boolean> - Whether a link is required or whether the file can be discovered through search.

• emailaddress <RegularExpression> - For types user and group, the required email address.

• domain <RegularExpression> - For type domain, the required domain name. For types user and group, the required domain name in the email address.

• name|displayname <RegularExpression> - For types domain, user and group, the displayable name.

• expirationstart <Time> - For types user and group, will the permission expire on or after .

• expirationend <Time> - For types user and group, will the permission expire before or on .

• deleted <Boolean> - For types user and groups, has the user or droup been deleted.

• endmatch - End of permission match definition

• permissionmatchmode or - If any matches, then there is a permissions match. This is the default.

• permissionmatchmode and - If all match, then there is a permissions match.

• permissionmatchaction process - If the permissions match, count/display the file. This is the default.

• permissionmatchaction skip - If the permissions match, do not count/display the file.

Examples

Process all files with permissions type anyone:

permissionmatch type anyone endmatch

Process all files except those with permissions type anyone:

permissionmatch type anyone endmatch
permissionmatchaction skip

Process all files with write access for [email protected] or [email protected]:

permissionmatch role writer type group emailaddress [email protected] endmatch
permissionmatch role writer type user emailaddress [email protected] endmatch

Process all files with write access for [email protected] and [email protected]:

permissionmatch role writer type group emailaddress [email protected] endmatch
permissionmatch role writer type user emailaddress [email protected] endmatch
permissionmatchmode and

Process all files where neither [email protected] or [email protected] have access:

permissionmatch type user emailaddress [email protected] endmatch
permissionmatch type user emailaddress [email protected] endmatch
permissionmatchaction skip

or you can use regular expressions

permissionmatch type user emailaddress "user[1|2]@domain.com" endmatch
permissionmatchaction skip

Process all files shared with group [email protected] and not shared with user [email protected]:

pm type group emailaddress [email protected] em pm not type user [email protected] em pmm and

Process all files shared with domain.com either directly or via a user or group.

pm domain domain.com em pm emailaddress ".*@comain.com" em