企业数字化办公的文档安全防线：基于 OnlyOffice 中国版的权限管控、动态水印与长轮询降级实践

{
  "editorConfig": {
    "customization": {
      "waterMark": {
        "value": "张三(工号:10086)\\n192.168.1.100\\n2026-04-12 14:30",
        "fillstyle": "rgba(192, 192, 192, 0.3)",
        "font": "18px SimHei",
        "rotate": -25,
        "horizontal": 50,
        "vertical": 50,
        "opacity": 0.3
      }
    }
  }
}

{
  "document": {
    "permissions": {
      "copy": true,
      "copyOut": false,
      "print": false,
      "download": false
    }
  }
}

{
  "editorConfig": {
    "customization": {
      "about": false,
      "feedback": false,
      "goback": false,
      "help": false,
      "plugins": false,
      "layout": {
        "statusBar": {
          "actionStatus": false,
          "docLang": false,
          "textLang": false
        }
      }
    }
  }
}

// 后端构建开档配置（伪代码）
function buildEditorConfig(user, document, clientIp) {
  return {
    document: {
      fileType: document.ext,
      key: document.versionKey,
      title: document.title,
      url: document.downloadUrl,
      permissions: {
        edit: false,
        copy: true,
        copyOut: false,
        print: false,
        download: false,
        comment: false
      }
    },
    editorConfig: {
      mode: "view",
      lang: "zh",
      customization: {
        about: false,
        feedback: false,
        goback: false,
        help: false,
        plugins: false,
        waterMark: {
          value: `${user.name}(${user.employeeId})\\n${clientIp}\\n${formatTime(new Date())}`,
          fillstyle: "rgba(192, 192, 192, 0.3)",
          font: "16px SimHei",
          rotate: -25,
          horizontal: 40,
          vertical: 40,
          opacity: 0.3
        }
      }
    }
  };
}

const securityProfiles = {
  // 公开级别
  public: {
    permissions: {
      edit: false,
      copy: true,
      copyOut: true,
      print: true,
      download: true
    },
    customization: {
      waterMark: null // 无水印
    }
  },

  // 内部级别
  internal: {
    permissions: {
      edit: false,
      copy: true,
      copyOut: false, // 禁止复制到外部
      print: true,
      download: false  // 禁止下载
    },
    customization: {
      waterMark: {
        value: "${userName}\\n内部资料",
        fillstyle: "rgba(200, 200, 200, 0.2)",
        font: "14px Arial",
        rotate: -30,
        horizontal: 60,
        vertical: 60,
        opacity: 0.2
      }
    }
  },

  // 机密级别
  confidential: {
    permissions: {
      edit: false,
      copy: false,     // 完全禁止复制
      copyOut: false,
      print: false,    // 禁止打印
      download: false  // 禁止下载
    },
    customization: {
      waterMark: {
        value: "${userName}(${userId})\\n${clientIp}\\n${timestamp}\\n机密文件",
        fillstyle: "rgba(255, 0, 0, 0.15)",
        font: "20px SimHei",
        rotate: -25,
        horizontal: 30,
        vertical: 30,
        opacity: 0.25
      }
    }
  }
};

// 创建连接器
const connector = docEditor.createConnector();

// 审批人点击"开始审批"按钮时
function onStartReview() {
  connector.callCommand(function () {
    Api.changePermissions({
      edit: false,
      comment: true,
      copy: true,
      copyOut: false,
      print: false
    });
  });
}

// 审批通过后，进入签署阶段
function onApproved() {
  connector.callCommand(function () {
    Api.changePermissions({
      edit: false,
      comment: false,
      copy: false,
      copyOut: false,
      print: false
    });
  });
}

// 审批驳回，退回给起草人编辑
function onRejected() {
  connector.callCommand(function () {
    Api.changePermissions({
      edit: true,
      comment: true,
      copy: true,
      copyOut: true,
      print: true
    });
  });
}

// 1. 初始化：用户只读模式，连接器可操作
const config = {
  editorConfig: {
    mode: "edit",
    permissions: { edit: true },
    customization: {
      readOnly: true,  // 用户无法手动编辑
      waterMark: {
        value: `${user.name}\n${user.ip}\n机密合同`,
        fillstyle: "rgba(255, 0, 0, 0.2)",
        font: "16px SimHei"
      }
    }
  },
  document: {
    permissions: {
      copy: true,
      copyOut: false,  // 禁止复制到外部
      print: false,
      download: false
    }
  }
};

// 2. 审批通过后，进一步收紧权限
function onContractApproved() {
  connector.callCommand(function () {
    Api.changePermissions({
      edit: false,
      comment: false,
      copy: false,      // 完全禁止复制
      copyOut: false,
      print: false
    });
  });
  
  // 注意：水印内容建议在开档时通过后端配置生成
  // 如需动态变更，需要重新加载文档或使用连接器操作后刷新
}