lark-workflow-doc-perm

Document Permission Manager Workflow

CRITICAL — Before starting, you MUST first use the Read tool to read ../lark-shared/SKILL.md, which contains authentication and permission handling

Applicable Scenarios

"Share document XXX with Zhang San and Li Si, editable" / "Set document permissions"
"Batch set project document permissions: engineering group read-only, product group editable" / "Batch authorize"
"Give edit permission for this document to the entire team" / "Document permission management"
"Share document with team" / "Document permission configuration"

Prerequisites

Requires user identity(to operate permissions on your own documents) and bot identity(to send notification messages). Before execution, ensure authorization has been granted:

lark-cli auth login --domain drive,wiki,contact,im

Workflow

{文档 URL 或 file_token + 授权人列表 + 权限级别}
  │
  ├── [wiki 链接] wiki spaces get_node ──► 解析真实 token + obj_type
  │
  ├── drive permission.members create ──► 批量授权（逐个，间隔 1s）
  │
  └── im +messages-send ────────────────► 通知被授权用户

Step 1: Parse document token

Wiki link handling

If the user provides a knowledge base link (https://xxx.feishu.cn/wiki/xxx), first parse it to obtain the real document token:

lark-cli wiki spaces get_node \
  --params '{"token":"<wiki_token>"}' \
  --as user

From the returned result, extract obj_token(the real document token) and obj_type(the document type).

Direct token

If the user directly provides a document token (doccnXXX、sheetXXX、bascnXXX , etc.), it can be used directly.

Determine document type

obj_type	Description	type parameter
`docx`	New version document	`docx`
`sheet`	Spreadsheet	`sheet`
`bitable`	Bitable	`bitable`
`doc`	Old version document	`doc`
`mindnote`	Mind map	`mindnote`
`file`	File	`file`

Step 2: Find target users to authorize

lark-cli contact +search-user --query "<用户姓名>" --as user

Record each user's open_id. Supports batch lookup of multiple users.

Step 3: Set permissions

View parameter structure

lark-cli schema drive.permission.members.create

Authorize one by one

Call once for each user (1 second interval, to avoid rate limiting):

lark-cli drive permission.members create \
  --params '{"token":"<file_token>","type":"<doc_type>"}' \
  --data '{
    "member_type": "openid",
    "member_id": "ou_xxx",
    "perm": "edit"
  }' \
  --as user

Permission levels:

perm value	Description	Applicable scenario
`full_access`	Full access	Document administrators, core collaborators
`edit`	Editable	Collaborators who need to modify the document
`view`	Read-only	Members who only need to view

Example of batch setting by role

# 工程组：只读
for user_id in "ou_aaa" "ou_bbb" "ou_ccc"; do
  lark-cli drive permission.members create \
    --params '{"token":"<file_token>","type":"docx"}' \
    --data "{\"member_type\":\"openid\",\"member_id\":\"$user_id\",\"perm\":\"view\"}" \
    --as user
  sleep 1
done

# 产品组：可编辑
for user_id in "ou_ddd" "ou_eee"; do
  lark-cli drive permission.members create \
    --params '{"token":"<file_token>","type":"docx"}' \
    --data "{\"member_type\":\"openid\",\"member_id\":\"$user_id\",\"perm\":\"edit\"}" \
    --as user
  sleep 1
done

Important：

Before setting full_access , you must confirm with the user (security rule)

At least 1 second interval between each call

If it prompts "no permission to operate", you need to confirm that the current user is the document owner or administrator

Step 4: Notify authorized users

lark-cli im +messages-send \
  --user-id "<user_open_id>" \
  --markdown "已为您开通文档「{文档标题}」的{权限级别}权限。

文档链接：{文档URL}

如有问题，请联系文档管理员。" \
  --as bot

Note: Send notification messages at 1 second intervals. If the number of authorized users exceeds 20, send in batches.

Fallback Strategy

Scenario	Fallback Plan
Wiki link parsing fails	Ask the user to directly provide the document token
User cannot be found	Prompt to confirm the name, or directly use open_id
Permission setting failed	Check whether the current user has document management permissions
Notification sending failed	List authorized users and let the user notify them manually
Rate limit	Reduce the speed to once every 2 seconds

Permission table

Command	Required scope
`wiki spaces get_node`	`wiki:node:read`
`contact +search-user`	`contact:user.base:readonly`
`drive permission.members create`	`drive:drive:write`
`im +messages-send`	`im:message`

Reference

../lark-drive/SKILL.md — Cloud space atomic operations
../lark-wiki/SKILL.md — Knowledge base operations
../lark-contact/SKILL.md — Contacts query
../lark-im/SKILL.md — Message sending