Synchronization of permissioned content in cloud-based environments
Enterprise administrators in a cloud-based environment including a cloud-based server and a repository can selectively impose permissions on items (e.g., files and folders) marked for synchronization (“sync items”). The sync items can be synchronized with the client devices of users by downloading the items along with the permission attributes from the cloud-based server. However, the permissions on those sync items means that any unpermitted changes to the local copies of the sync items do not get uploaded to the cloud-based server. A synchronization client on the client devices detects any changes made locally to the sync items that are not consistent with the permission attributes, and repairs those changes so that the sync items are restored to their most recent states. This ensures that any unauthorized changes made to sync items remain local and do not propagate by the synchronization process to other users.
1. A method of checking a content item marked for synchronization between a cloud-based server and at least one computer system, the method comprising:
receiving, by the cloud-based server, a request for a permission check from the at least one computer system, the request based on a change to the content item by a user of the at least one computer system, wherein the content item is marked for synchronization between the cloud-based server and at the at least one computer system, wherein the content item is associated with at least one permission attribute cached on the at least one computer system, and wherein the request is received prior to an attempt to upload the change to the content item to the cloud-based server;
determining, by the cloud-based server, an access level of the user;
performing, by the cloud-based server, a permission check based on the permission attribute of the content item and the access level of the user; and
notifying, by the cloud-based server, the at least one computer system of a result of performing the permission check, the result indicating that the change to the content item will be accepted or rejected by the cloud-based server during a synchronization procedure, wherein the at least one computer system restores the content item in response to the result indicating that the change to the content item will be rejected by the cloud-based server.
2. The method of claim 1 , wherein the cloud-based server is associated with a cloud-based storage and collaboration platform, and wherein the permission check is received by the cloud-based server through a pre-flight application program interface (API) of the cloud-based server and without receiving the content item at the cloud-based server.
3. The method of claim 2 , wherein the content item is a folder, a sub-folder, or a file, the folder including a sub-folder or a file, and the sub-folder including a file, wherein the content item is stored in a workspace hosted at cloud-based storage, the workspace being associated with an enterprise and managed by an enterprise administrator.
4. The method of claim 3 , wherein the enterprise administrator associates the at least one permission attribute with the content item that is marked for synchronization between the cloud-based server and the at least the computer system.
5. The method of claim 2 , wherein the at least one permission attribute permits or restricts a user action that changes the content item, the user action including one or more of: creating a new content item inside the content item, moving the content item to another location, deleting the content item, editing the content item, or renaming the content item.
6. The method of claim 2 , wherein the at least one permission attribute permits or restricts a user action to add or create a tag for the content item, assign a task for the content item, access the content item from multiple computer systems, access the content item from a mobile device or invite external users to collaborate on the content item.
7. The method of claim 1 , wherein the cloud-based server and at least one computer system synchronize the content item in response to the result indicating that the change to the content item will be accepted by the cloud-based server.
8. A cloud-based server comprising:
a processor; and
a memory coupled with and readable by the processor and storing therein a set of instructions which, when executed by the processor, causes the processor to check a content item marked for synchronization between a cloud-based server and at least one computer system by:
receiving a request for a permission check from the at least one computer system, the request based on a change to the content item by a user of the at least one computer system, wherein the content item is marked for synchronization between the cloud-based server and at the at least one computer system, wherein the content item is associated with at least one permission attribute cached on the at least one computer system, and wherein the request is received prior to an attempt to upload the change to the content item to the cloud-based server,
determining an access level of the user,
performing a permission check based on the permission attribute of the content item and the access level of the user, and
notifying the at least one computer system of a result of performing the permission check, the result indicating that the change to the content item will be accepted or rejected by the cloud-based server during a synchronization procedure, wherein the at least one computer system restores the content item in response to the result indicating that the change to the content item will be rejected by the cloud-based server.
9. The cloud-based server of claim 8 , wherein the cloud-based server is associated with a cloud-based storage and collaboration platform, and wherein the permission check is received by the cloud-based server through a pre-flight application program interface (API) of the cloud-based server and without receiving the content item at the cloud-based server.
10. The cloud-based server of claim 9 , wherein the content item is a folder, a sub-folder, or a file, the folder including a sub-folder or a file, and the sub-folder including a file, wherein the content item is stored in a workspace hosted at cloud-based storage, the workspace being associated with an enterprise and managed by an enterprise administrator.
11. The cloud-based server of claim 10 , wherein the enterprise administrator associates the at least one permission attribute with the content item that is marked for synchronization between the cloud-based server and the at least the computer system.
12. The cloud-based server of claim 9 , wherein the at least one permission attribute permits or restricts a user action that changes the content item, the user action including one or more of: creating a new content item inside the content item, moving the content item to another location, deleting the content item, editing the content item, or renaming the content item.
13. The cloud-based server of claim 9 , wherein the at least one permission attribute permits or restricts a user action to add or create a tag for the content item, assign a task for the content item, access the content item from multiple computer systems, access the content item from a mobile device or invite external users to collaborate on the content item.
14. The cloud-based server of claim 8 , wherein the cloud-based server and at least one computer system synchronize the content item in response to the result indicating that the change to the content item will be accepted by the cloud-based server.
15. A non-transitory, computer-readable medium comprising a set of instructions stored therein which, when executed by a processor, causes the processor to check a content item marked for synchronization between a cloud-based server and at least one computer system by:
receiving, by the cloud-based server, a request for a permission check from the at least one computer system, the request based on a change to the content item by a user of the at least one computer system, wherein the content item is marked for synchronization between the cloud-based server and at the at least one computer system, wherein the content item is associated with at least one permission attribute cached on the at least one computer system, and wherein the request is received prior to an attempt to upload the change to the content item to the cloud-based server;
determining, by the cloud-based server, an access level of the user;
performing, by the cloud-based server, a permission check based on the permission attribute of the content item and the access level of the user; and
notifying, by the cloud-based server, the at least one computer system of a result of performing the permission check, the result indicating that the change to the content item will be accepted or rejected by the cloud-based server during a synchronization procedure, wherein the at least one computer system restores the content item in response to the result indicating that the change to the content item will be rejected by the cloud-based server.
16. The non-transitory, computer-readable medium of claim 15 , wherein the cloud-based server is associated with a cloud-based storage and collaboration platform, and wherein the permission check is received by the cloud-based server through a pre-flight application program interface (API) of the cloud-based server and without receiving the content item at the cloud-based server.
17. The non-transitory, computer-readable medium of claim 16 , wherein the content item is a folder, a sub-folder, or a file, the folder including a sub-folder or a file, and the sub-folder including a file, wherein the content item is stored in a workspace hosted at cloud-based storage, the workspace being associated with an enterprise and managed by an enterprise administrator.
18. The non-transitory, computer-readable medium of claim 17 , wherein the enterprise administrator associates the at least one permission attribute with the content item that is marked for synchronization between the cloud-based server and the at least the computer system.
19. The non-transitory, computer-readable medium of claim 16 , wherein the at least one permission attribute permits or restricts a user action that changes the content item, the user action including one or more of: creating a new content item inside the content item, moving the content item to another location, deleting the content item, editing the content item, or renaming the content item.
20. The non-transitory, computer-readable medium of claim 16 , wherein the at least one permission attribute permits or restricts a user action to add or create a tag for the content item, assign a task for the content item, access the content item from multiple computer systems, access the content item from a mobile device or invite external users to collaborate on the content item.