Preventing document checkout if not needed

Question

Hi M-Files and community, 
 We have specific case where some power users in last workflow step can change certain metadata before doing workflow transition. This works well through validation so we kind of force users to do transition if they change certain metadata. 
 However, as those users have edit rights, they can also checkout document. To be able to prevent content changes, I have used Utilities File Version concept and server side validation to check if someone changed content in that workflow step. This also works well and users are confronted with server side error wrapped in M-Files plugin window if they try to change content. 
 The question which arises why they are able to check the document in the first place. Server side validation is generally not very user friendly and annoys users with stack trace details. 
 So the question, is there any option to prevent checkout in certain workflow steps through some general configuration? I am not aware but perhaps I miss something. 
 Best regards, 
 Dejan

Radu Moca · Answer

Hello, 
 
 I added a validation on before checkout to check if the user is admin can edit a file, if not it gives an error to end user that they cannot modify the file. 
 
 probably you can do the same using state as trigger. 
 I can give you pieces of code on Monday if you need .

Radu Moca · Answer

Hey, 
 This in an old script, but it might help you in your case: 
 You need to test it, because I am not sure if it works. This is a VB script, in AfterCheckout Event Handler 
 If ObjVer.Type = 112 Then
	Dim userID : userID = CurrentUserID
	'Err.Raise MFScriptCancel, userID

 Dim groups : Set groups = vault.UserGroupOperations.GetGroupsOfUserOrGroup(userID, true)
	
	Dim check : check = false

 For Each group In groups
	'Err.Raise MFScriptCancel, group.Name
 if group.Name = "Secretary" Then
 check = true
 End If
	
	Next

 If userID = 24 or userID = 192 Then 
 check = true
	End If
	'Err.Raise MFScriptCancel, check
	If check = false Then

 Dim sObjVersions
 Set sObjVersions = CreateObject("MfilesAPI.ObjectVersions")
 Set sObjVersions = Vault.ObjectOperations.GetHistory(ObjVer.ObjID)
 dim versionnum
 i=1
 Dim oFilesold: Set oFilesold = vault.ObjectFileOperations.GetFiles(sObjVersions(2).ObjVer)
 Dim oFilesnew: Set oFilesnew = vault.ObjectFileOperations.GetFiles(ObjVer)
 dim check1
 for i=1 to oFilesold.count
 if (oFilesold(i).FileVer.Version <> oFilesnew(i).FileVer.Version ) Then
 check1 = true
 End if
 Next
 if check1 = true then
 vault.ObjectOperations.ForceUndoCheckout(ObjVer)
 Err.Raise MFScriptCancel, "This files cannot be modified!" & vbcrlf & "Open file in Read-Only mode!" 
 End If
	End If
End If 
 
 This is a VAF code for blocking editing of templates, but with a little work, you can use it in your use case (maybe a combination of the above script and this one: 
 [EventHandler(MFEventHandlerType.MFEventHandlerBeforeCheckOut)]
 private void DoNotEditTemplates(EventHandlerEnvironment env)
 {
 if (env.ObjVerEx.Type == (int)MFBuiltInObjectType.MFBuiltInObjectTypeDocument && env.ObjVerEx.IsTemplate && env.CurrentUserID > 0)
 {
 UserAccount useredit = env.Vault.UserOperations.GetUserAccount(env.CurrentUserID);



 if (useredit.VaultRoles.ToString() != "3079") //3079 - Full Control of Vault
 {
 throw new Exception("You do not have permissions to edit Templates.");
 }
 }

 }