Clarity on EffectiveBasePermissions object

Question

I recently used some code I found on this site to help resolve a problem. It worked with no issues.

The one thing that is bugging me though is there is a portion of code I do not quite understand what it's doing. Still getting my head wrapped around objects at times but improving.

The original code is below. The part that I do not understand is the

manageListsPerms.initPropertiesFromJson(data.d.EffectiveBasePermissions);

Is this taking the data object returned from the REST call and changing it to "something". I think because there is no equal sign (lol) between the manageListPerms and initPropertiesFromJson is what is throwing me off. Not sure though. But, that value (manageListPerms) is being used in the next statement and that is why it is throwing me off.

Just looking for a clear understanding to help with my own knowledge.

Thanks.

Original Code:

function checkPermissions() {
    var call = jQuery.ajax({
        url: _spPageContextInfo.webAbsoluteUrl +
            "/_api/Web/effectiveBasePermissions",
        type: "GET",
        dataType: "json",
        headers: {
            Accept: "application/json;odata=verbose"
        }
    });
call.done(function (data, textStatus, jqXHR) {
    var manageListsPerms = new SP.BasePermissions();
    manageListsPerms.initPropertiesFromJson(data.d.EffectiveBasePermissions);

    var manageLists = manageListsPerms.has(SP.PermissionKind.manageLists);

    var message = jQuery("#message");
    message.text("Manage Lists: " + manageLists);
});

}

The link to the original post can be found here: How to get permission of a sharepoint list for a user using REST api

Answer 1

The method is consuming the effective permissions for the current user (otherwise you would have an empty base permissions object). You can then use the base permissions object (manageListsPerms) to determine if the user has the manage lists permission level (where you are using the has method). The has method returns a boolean, which you are using at the end of your code.

Answer 2

I think some of your confusion might be coming from the fact that the variables in the code example you pulled are named in a fairly confusing way.

What if we renamed some of those and changed that done callback like this:

call.done(function (data, textStatus, jqXHR) {
var permissionsUserHasOnWeb = data.d.EffectiveBasePermissions;

var iAmABasePermissionObj = new SP.BasePermissions();
iAmABasePermissionObj.initPropertiesFromJson(permissionsUserHasOnWeb);

var userCanManageLists = iAmABasePermissionObj.has(SP.PermissionKind.manageLists);

var message = jQuery("#message");
message.text("Manage Lists: " + userCanManageLists);

});

When you make your call to

_spPageContextInfo.webAbsoluteUrl + "/_api/Web/effectiveBasePermissions"

what you get back is the permissions (encoded in a permission mask) that the current user has on that site.

var permissionsUserHasOnWeb = data.d.EffectiveBasePermissions;

Because it's encoded, that data is fairly indecipherable on its own, so you want to use the SP.BasePermissions class to help you decode that information so you can check to see if it includes the specific permissions you are checking for.

So, first, you create a new object to do the work:

var iAmABasePermissionObj = new SP.BasePermissions();

But, as Callum Crowley mentioned in their answer, when you create it initially it's empty, so you have to set it to the permissions of the user that you just got from the site in order to check against those permissions. initPropertiesFromJson() is a function that's available on an SP.BasePermissions object, and it's used to set itself. You could think of this:

iAmABasePermissionObj.initPropertiesFromJson(permissionsUserHasOnWeb);

as this:

iAmABasePermissionObj.letMeSetMyselfBasedOnJsonInput(permissionsUserHasOnWeb);

Then, once the users permissions are set in the SP.BasePermissions object, you can use another function (has()) that's available on that object to check to see if the full permissions it's set to includes the particular permission level you want to check for. That function outputs a boolean (true/false) value:

var userCanManageLists = iAmABasePermissionObj.has(SP.PermissionKind.manageLists);

I think it's important to note that the official documentation for the SP.BasePermissions object does not mention the initPropertiesFromJson method, and in fact if you search specifically for that method/function, the resulting documentation page says clearly

This member is reserved for internal use and is not intended to be used directly from your code.

So... it works, but be careful using it.