Modifies the rights of an existing role in place: UUID, other rights, RLS, and templates are preserved.
Creating a new role — /role-compile.
Parameters and command
| Parameter | Description |
|---|---|
RolePath |
Role directory, Roles/Имя.xml or Roles/Имя/Ext/Rights.xml |
Operation |
One operation from the table below |
Value |
Operation value; multiple values — separated by ;; |
DefinitionFile |
JSON array of operations (alternative to Operation) — this is how multiple different operations are specified |
NoValidate |
Do not run role-validate after editing |
powershell.exe -NoProfile -File "${CLAUDE_SKILL_DIR}/scripts/role-edit.ps1" -RolePath "<роль>" -Operation <op> -Value "<значение>"
Operations are applied in the order in which they are listed.
Operations
| Operation | Format Value |
Description |
|---|---|---|
add-rights |
Тип.Имя: Право1, Право2 or Тип.Имя: @пресет |
Add rights, preserve existing ones |
set-rights |
same | Replace the object's entire set of rights |
remove-rights |
Тип.Имя: Право1, Право2 — revoke rightsТип.Имя — delete the object entirely |
Revoke rights |
deny-rights |
Тип.Имя: Право1, Право2 |
Close an attribute or tabular section that would otherwise inherit the object's rights |
set-rls |
Тип.Имя.Право: условиеТип.Имя.Право[Поле1, Поле2]: условие |
Data access restriction |
remove-rls |
Тип.Имя.Право — remove allТип.Имя.Право[Поле1] — remove one row |
Remove the restriction, keep the right |
add-template |
Имя(Параметры): условие |
Add a restriction template |
set-template |
same | Replace the template, or add it if it does not exist |
remove-template |
Имя(Параметры) or Имя |
Delete the template |
modify-property |
setForNewObjects=truesetForAttributesByDefault=falseindependentRightsOfChildObjects=true |
Global role flags |
set-synonym |
text | Role synonym |
set-comment |
text | Role comment |
Quick examples
# Добавить права нового регистра, ничего не потеряв
... -RolePath "src/Roles/Менеджер" -Operation add-rights -Value "InformationRegister.Цены: Read, Update"
# Пресет и несколько объектов в одном вызове
... -RolePath "src/Roles/Менеджер" -Operation add-rights -Value "Catalog.Товары: @view ;; Document.Заказ: @edit"
# Снять права; объект без разрешающих прав удаляется целиком
... -RolePath "src/Roles/Менеджер" -Operation remove-rights -Value "Document.Заказ: Delete"
# Закрыть реквизит от роли
... -RolePath "src/Roles/Менеджер" -Operation deny-rights -Value "Catalog.Товары.Attribute.Цена: View"
Multiple different operations — as a list in a file:
[
{ "operation": "add-rights", "value": "Catalog.Товары: @view" },
{ "operation": "set-rls", "value": "Catalog.Товары.Read: #ПоОрганизации(\"\")" }
]
... -RolePath "src/Roles/Менеджер" -DefinitionFile "операции.json"
Rights
Object and right names are the same as in /role-compile: Catalog, Read, presets @view и
@edit, nested paths (Catalog.Контрагенты.Attribute.ИНН: View, Edit), short service notation
(HTTPService.ЭДО: Use expands to all methods of URL templates).
remove-rights и deny-rights affect more than what is listed: rights that the removed item needs also go away (they removed Read — they will go away Update, View, Edit). The cascade removal is listed in the output.
An error in the value means rejection before writing; the file is not changed. Full tables “type → rights” and kinds of nesting are in the help /role-compile.
RLS
Rights restrictions are a list of strings, as in the “Data access restrictions” table of the editor. A row without a field list applies to all other fields; a row with a list applies only to them. A typical technique: close the data entirely but leave the fields of the reference representation open, otherwise references to the object will turn into “object not found”:
... -Operation set-rls -Value "Catalog.Товары.Read: ГДЕ ЛОЖЬ"
... -Operation set-rls -Value "Catalog.Товары.Read[Ссылка, Код, Наименование]: "
A row with the same set of fields is replaced; with a different one, it is added. The right must already be granted: the platform ignores a restriction without a right, so the skill will fail.
Template reference — #ИмяШаблона(""); & in conditions is escaped automatically.
Value from file
Instead of text, you can specify @путь — the RLS condition, template body, synonym, and comment are taken from the file. A relative path is searched next to DefinitionFile, then in the current directory. Separator
;; inside the file remains ordinary text.
... -Operation set-rls -Value "Catalog.Товары.Read: @условие.txt"
... -Operation add-template -Value "ПоОрганизации(Мод): @условие.txt"
... -Operation set-comment -Value "@комментарий.txt"
Verification
/role-info <RightsPath> — сводка прав после правки
/role-validate <RightsPath> — проверка корректности (запускается автоматически)