How to automatically check if a user has access to a document in nuxeo?

[Zakariyaa]

I need a way to quickly verify if a user has access to a document without retrieving and scanning all ACLs. Is there an API or an optimized method in Nuxeo to check access directly with a simple boolean response (true/false)?

[Josh-F-Hyland]

I'm curious about the use case. Why would you need this? If a user doesn't have access to a document, Nuxeo will simply give a 404 when that user requests it (e.g. assuming the user had the path or UUID in the first place). No search will return any document the user doesn't have access to. I.e. it's important to *not* give a reply that implies the document exists when a user has no access to it as this could be exploited. The permission layer is always on in Nuxeo, there's no way for a user to access something they don't have access to.

[Zakariyaa]

Thank you for your response. My use case requires checking outside of Nuxeo, using only the user's ID and document ID, to determine if the user has read access before making any API calls to Nuxeo. Is there an API or a method in Nuxeo that allows checking if a user has read permission on a document without retrieving all ACLs, ideally returning a simple true/false response? Additionally, is it possible to integrate a mechanism within Nuxeo that precomputes read permissions for each document, for example, by listing all users who have read access in advance and updating this information periodically?

[Josh-F-Hyland · Accepted solution]

I have to correct my previous reply, you get a 403 error if the user doesn't have access, not a 404. I don't know of any specific endpoint for this but you could certainly build an Automation Chain or Automation Script to do it. However I would suggest that you simply fetch the document; if the user doesn't have access you'll get a 403 error and can handle as appropriate. No need to a separate endpoint.

[Zakariyaa]

Ok thanks !