Accepts a JSON role definition → generates Roles/Имя.xml (metadata) and Roles/Имя/Ext/Rights.xml (rights). UUID automatically.
Parameters and command
| Parameter | Description |
|---|---|
JsonPath |
Path to the JSON role definition |
OutputDir |
Configuration dump root (where Configuration.xml, Roles/ и т.д.) |
powershell.exe -NoProfile -File "${CLAUDE_SKILL_DIR}/scripts/role-compile.ps1" -JsonPath "<json>" -OutputDir "<ConfigDir>"
Creates {OutputDir}/Roles/Имя.xml и {OutputDir}/Roles/Имя/Ext/Rights.xml. Registers <Role> в Configuration.xml.
JSON DSL
Structure
{ "name": "ИмяРоли", "synonym": "Отображаемое имя", "objects": [...], "templates": [...] }
Optional: comment (""), setForNewObjects (false), setForAttributesByDefault (true), independentRightsOfChildObjects (false).
Shorthand strings and object form
"objects": [
"Catalog.Номенклатура: @view",
"Document.Реализация: @edit",
"DataProcessor.Загрузка: @view",
"InformationRegister.Цены: Read, Update",
{ "name": "Document.Продажа", "preset": "view", "rls": {"Read": "#Шаблон(\"\")"} },
{ "name": "Catalog.Номенклатура.Attribute.Цена", "rights": {"View": false} }
]
- Shorthand:
"Тип.Имя: @пресет"or"Тип.Имя: Право1, Право2" - Object form:
preset+rights(dotted rights values) +rls(restrictions)
Presets
| Preset | Action |
|---|---|
@view |
View — Read, View (+InputByString for catalogs/documents; Use+View for data processors/reports) |
@edit |
Full editing — CRUD + Interactive* + Posting (documents) |
@ is required in shorthand. In object form — "preset": "view" without @.
Services
The right lives on the nested object of the service — on a URL template method, operation, or channel; it never exists on the service as a whole. The whole service — a short notation, the skill will expand it using metadata in OutputDir:
"objects": ["HTTPService.ЭДО: Use"]
→ HTTPService.ЭДО.URLTemplate.ЕстьНовыеДокументы.Method.POST: Use, and so on for each method of each template.
Some routes — with the full path: "HTTPService.ЭДО.URLTemplate.ЕстьНовыеДокументы.Method.POST: Use".
RLS templates
"templates": [{"name": "ДляОбъекта(Мод)", "condition": "ГДЕ Организация = &ТекОрг"}]
Reference in rls: "#ДляОбъекта(\"\")". The character & is automatically escaped in XML.
Keep a long condition in a file — the value contains @путь. A relative path is searched next to
the JSON role description, then in the current directory:
"objects": [{"name": "Document.Продажа", "preset": "view", "rls": {"Read": "@условие.txt"}}],
"templates": [{"name": "ДляОбъекта(Мод)", "condition": "@шаблон.txt"}]
Examples
Simple role
{
"name": "ЧтениеНоменклатуры", "synonym": "Чтение номенклатуры",
"objects": ["Catalog.Номенклатура: @view", "Catalog.Контрагенты: @view", "DataProcessor.Загрузка: @view"]
}
Role with RLS
{
"name": "ЧтениеДокументовПоОрганизации",
"synonym": "Чтение документов (ограничение по организации)",
"objects": [
"Catalog.Организации: @view",
{"name": "Document.РеализацияТоваровУслуг", "preset": "view", "rls": {"Read": "#ДляОбъекта(\"\")"}}
],
"templates": [{"name": "ДляОбъекта(Модификатор)", "condition": "ГДЕ Организация = &ТекущаяОрганизация"}]
}
What can be written in objects
Rights do not exist for Enum, CommonModule, DefinedType, CommonPicture, CommonTemplate, Language, FunctionalOption, EventSubscription, ScheduledJob, StyleItem, SettingsStorage and the like — they are not in the role editor tree. An error in the description — rejection before writing: files are not created, Configuration.xml does not change.
Rights on parts of an object are specified with a dotted path: Catalog.Контрагенты.Attribute.ИНН: View, Edit, WebService.Обмен.Operation.Загрузить: Use, HTTPService.ЭДО.URLTemplate.ЕстьНовыеДокументы.Method.POST: Use.
Attributes, tabular sections, dimensions, and resources inherit the rights of their object — they are given a prohibition to close the inherited rights:
{"name": "Catalog.Товары.Attribute.Цена", "rights": {"View": false}}
The extension role included in the main ones (DefaultRoles), cannot grant rights to borrowed objects — the platform prohibits this. Move such rights into a separate role outside the main ones.
Complete tables "type → rights", nesting kinds (including external data sources), the list of types without rights, preset tables, and additional examples — in dsl-reference.md.
Verification
/role-validate <RightsPath> — проверка корректности XML, прав, RLS
/role-info <RightsPath> — визуальная сводка структуры