Document Protection and User Permissions

Document protection answers one question well: what may a user change in this document, in this editor? A protected document in the WPF TextControl limits editing and formatting, and its editable regions stay open for everyone or for a named user. It answers other questions poorly or not at all: who may read the document, whether it was changed and who the user really is. Where the protection ends, and how your application fills the gaps, is the subject here.

Setting up protection with the Permissions tab and in code is shown in Document Protection and Editable Regions. The code below belongs in MainWindow.xaml.cs of a window with a TextControl named textControl1.

How a Document Is Protected

EditMode set to ReadAndSelect, optionally combined with UsePassword, switches the restrictions on, DocumentPermissions sets what stays allowed, and editable regions remain open for one user name or for all users. RTF, DOC, DOCX, PDF and the TX Text Control format keep the permissions and the password in encrypted form, which Text Control calls compatible with Microsoft Word. How Document Protection Works describes the edit modes and each permission.

What It Keeps From Happening

• Unwanted changes in the editor. Outside the regions of the current user, the TextControl allows only what the permissions allow.
• Lifting the protection without the password. A document protected with a password is opened read-only, and switching the edit mode back to Edit requires the same password.
• Commands that shouldn't be offered. For your own buttons and menu items, CanEdit, CanPrint and CanCopy say whether the action is allowed at the moment.

What It Leaves Open

• Reading. Protection restricts changes, not access: a protected document opens read-only, and its text can be read and selected. Confidential content needs a PDF with a user password, as PDF Passwords and Permissions explains.
• Restrictions without a password. According to Text Control's article on document permissions, the permissions are saved in the document only when EditMode is ReadAndSelect together with UsePassword. Restrictions set without a password last only as long as the document is open, and setting EditMode to Edit removes them.
• Access for everyone who has the password. The protection password serves as the master password of the document. Loading the document with it in MasterPassword of the LoadSettings removes all restrictions.
• Evidence of changes. Nothing in a protected document shows whether someone with the password edited it. For that, sign the PDF you hand out, as Certificate and Private Key Handling describes.

Set User Names From Your Sign-In

UserNames lists the users who have access to editable regions: when a document is read-only, the regions of these users can be edited. The TextControl takes the names as they are. It has no sign-in of its own, so a name typed into a box and passed on unchecked opens that user's regions to anybody.

The WPF version of the TX Words sample User Access demonstrates it. As long as nobody is signed in, only the region for all users is highlighted and can be changed:

Its Sign In command opens a password dialog box of the sample, in which a new user account is created on the first sign-in:

After a successful sign-in, the sample assigns the signed-in user's name to UserNames. John's region is now highlighted and editable too:

Do the same in your application: take the name from the user your application authenticated, and assign it before the document is loaded:

private void OpenForSignedInUser(string signedInUserName)
{
    // The name comes from your application's sign-in, not from a text box
    textControl1.UserNames = new string[] { signedInUserName };

    textControl1.Load("contract.docx", StreamType.WordprocessingML);
}

Call the method once the TextControl has raised its Loaded event, for example from the handler of a menu command. The first name is also the author of new comments and tracked changes. In the Add Users dialog box of the Permissions tab, RegisteredUserNames and AllowAddingUserNames restrict the names to those of your application, as Protect a Document With the Ribbon describes.

Unlock Protected Documents in Code

Code needs the protection password just as users do. Text Control's articles pass it in MasterPassword to load a protected document without restrictions, for example to save it as PDF with a ServerTextControl:

private void ExportContractButton_Click(object sender, RoutedEventArgs e)
{
    using (ServerTextControl tx = new ServerTextControl())
    {
        tx.Create();

        // The password of the protection lifts all restrictions
        LoadSettings loadSettings = new LoadSettings()
        {
            MasterPassword = protectionPassword
        };

        tx.Load("contract.tx", StreamType.InternalUnicodeFormat, loadSettings);
        tx.Save("contract.pdf", StreamType.AdobePDF);
    }
}

The code works as follows:

• Create initializes the ServerTextControl; it's called before any other member.
• protectionPassword is a field of the window. Ask for the password or read it from a protected store when you need it; a password written into the source code is part of every installed copy of your application.
• Without the password, the loaded document remains protected, and the article reports that it can't be exported to PDF as it is.

The reference documents MasterPassword as a setting for PDF documents; its use for other protected formats is taken from the articles Document Permissions and Password Encryption and Exporting Password Protected Documents to PDF in .NET C#.

Which Protection Fits

Next Steps

• Document Protection and Editable Regions: the ribbon and the code for protected documents.
• PDF Passwords and Permissions: protection for documents that leave your application.
• Form Fields and Conditional Instructions: fields that stay editable in protected forms.
• Security Overview: the other protections and what your application decides.