Change permissions of a SharePoint list using JavaScript

Question

I have an app that creates a list. I'd like the app to also set the list permissions to only allow admins to make changes to the list. I know how to hide the list, but I understand that this will not prevent clever users from typing in the URL of the list and modifying it anyway.

I don't see a way of changing list permissions with JavaScript. The functions available to me for lists don't seem to allow for modification of permissions, but it's possible I overlooked the correct one(s).

Any pointers on what functions I should be looking at?

Answer 1

How to enable unique permissions for a List object via JSOM

Use SP.SecurableObject.hasUniqueRoleAssignments property to determine whether the role assignments are uniquely defined for a List or inherited from a parent securable object.

Use SP.SecurableObject.breakRoleInheritance(copyRoleAssignments, clearSubscopes) Method to set unique role assignments for the List object.

Example

var listTitle = 'Documents';
var context = SP.ClientContext.get_current();
var list = context.get_web().get_lists().getByTitle(listTitle);   

context.load(list,'HasUniqueRoleAssignments'); 
context.executeQueryAsync(
   function(){
      var hasUniqueAssgns = list.get_hasUniqueRoleAssignments();
      if(!hasUniqueAssgns) {
         list.breakRoleInheritance(false, true);
         context.executeQueryAsync(
            function(){
                console.log('Success');
            }, 
            function(sender,args){
               console.log(args.get_message());    
            }
         );
      }
   }, 
   function(sender,args){
      console.log(args.get_message());    
   }
);

How to grant custom permissions for a List object via JSOM

The following example demonstrates how to break role inheritance for a List object and grant Full Control permissions for a current user

Example

var listTitle = 'Documents';
var context = SP.ClientContext.get_current();
var list = context.get_web().get_lists().getByTitle(listTitle);   
var currentUser = context.get_web().get_currentUser();

list.breakRoleInheritance(false, true); // break role inheritance first!

var roleDefBindingColl = SP.RoleDefinitionBindingCollection.newObject(context);
roleDefBindingColl.add(context.get_web().get_roleDefinitions().getByType(SP.RoleType.administrator));
list.get_roleAssignments().add(currentUser, roleDefBindingColl);

context.executeQueryAsync(
   function(){
      console.log('Success');
   }, 
   function(sender,args){
      console.log(args.get_message());    
   }
);