Applying Constraints for System Accounts (for System Applications Only)

The account module provides a role-based access control mechanism. You can set constraints for system accounts to restrict their behaviors.

Constraints

For details about the predefined account constraints, see Constraints.

Getting Started

Request the ohos.permission.MANAGE_LOCAL_ACCOUNTS permission. For details, see Requesting Permissions for system_basic Applications.
Import the osAccount module.

import { osAccount, BusinessError } from '@kit.BasicServicesKit';

Obtain an AccountManager instance.

let accountManager = osAccount.getAccountManager();

Setting Constraints for a System Account

The user can set constraints to restrict the system account behaviors. For example, the user can enable mobile guardian for children to prevent the kids to use Wi-Fi or install applications.

Procedure

Specify the system account ID and the constraints.

    let localId: number = 100;
    let constraint: string[] = [ 'constraint.wifi.set' ];

Use setOsAccountConstraints to enable the constraints for the system account.

    try {
      accountManager.setOsAccountConstraints(localId, constraint, true);
      console.info('setOsAccountConstraints successfully');
	// ···
    } catch (e) {
      const err = e as BusinessError;
      console.error(`setOsAccountConstraints failed, error: code is ${err.code}, message is ${err.message}`);
	// ···
    }

Checking Whether a Constraint Can be Enabled for a System Account

Before a constraint is enabled for a system account, the application needs to check whether the constraint can be enabled. You can use isOsAccountConstraintEnabled to implement this operation.

Procedure

Set the system account ID and constraint.

    let localId: number = 100;
    let constraint: string = 'constraint.wifi.set';

Use isOsAccountConstraintEnabled to check whether the constraint can be enabled for the system account.

    accountManager.isOsAccountConstraintEnabled(localId, constraint).then((isEnabled: boolean) => {
      if (isEnabled) {
        // your business logic
		// ···
      }
    });