[OneDev #38] sharepoint-external-sharing-report: filter out stale siteusers entries #1
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Imported from OneDev issue #38 (id 35590)
Original project: internal-joseph
Original state: Open
Original submitterId: 5
Original submitDate: 2026-05-08T19:33:22.516+00:00
Original lastActivity: {'date': '2026-05-08T19:33:22.516+00:00', 'description': 'opened', 'userId': 5}
Original fields:
Problem
HSC's external sharing report listed Ami Cheek with "web-only limited access" on the
/Boardsubsite even though she has zero actual permissions there:She appeared because SharePoint's
siteuserscollection is sticky — once a user is referenced anywhere on a site (old sharing link, file metadata Created/Modified By, prior group membership), they stay insiteuserspermanently. The report (or whatever path produced the entry Barbara saw) treats that as "has access."Barbara reasonably read this as "Ami can see Board files" and asked me to remove access that doesn't exist.
Fix
sp_report_v2.pyshould not include any user as a finding unless the user has an actual current permission grant. Concretely:/web/getUserEffectivePermissionsreturning non-zero High|Low, ORroleassignmentsexpansion (not just siteusers).If neither, drop them from the output.
Done-when
Re-running the HSC report does NOT list Ami Cheek (or anyone else with
effectivePermissions == 0).Reference
internal-joseph/skills/sharepoint-external-sharing-report/sp_report_v2.py/_api/web/getUserEffectivePermissions(@user)?@user='i:0%23.f|membership|<upn>'returns{High, Low}— both 0 = no real access.