It is SharePoint Permission call FullMask or "NearFullMask" in CSOM?

This Post is about SharePoint JSOM and RESt and how SharePoint deals with FullMask Permission in Client Side Object Mode and what means High and Low Properties in BasePermission Object on SharePoint Object Model.

This topic was first talked and promissed in the following post:

How to Convert REST Call to SharePoint JSOM Object (ECMAScript)

when we configure permission of user permission it is possible to define some type of permissions templates to users or some Web Object like "UserCustomActions", the same way we do with declarative XML.
But when i was making and my SharePoint App "SharePoint App Processlynx Custom Action and Ribbon Manager Launch" and was validating the permission field found out that FullMask is not really FullMask.... here are my findings.

Here are the results about the “BasePermissions” Issue in SharePoint Client Object Model (SP.BasePermissions) and REST:

This are the values of all possible “PermissionKinds” im SCOM (split in two parts – the low and high “PermissionKinds”) :

For the low “PermissionKinds” from 1 to 32:

01: 0000000001: 0000000000000000000000000000001: ViewListItems

02: 0000000002: 0000000000000000000000000000010: AddListItems

03: 0000000004: 0000000000000000000000000000100: EditListItems

04: 0000000008: 0000000000000000000000000001000: DeleteListItems

05: 0000000016: 0000000000000000000000000010000: ApproveItems

06: 0000000032: 0000000000000000000000000100000: OpenItems

07: 0000000064: 0000000000000000000000001000000: ViewVersions

08: 0000000128: 0000000000000000000000010000000: DeleteVersions

09: 0000000256: 0000000000000000000000100000000: CancelCheckout

10: 0000000512: 0000000000000000000001000000000: ManagePersonalViews

12: 0000002048: 0000000000000000000100000000000: ManageLists

13: 0000004096: 0000000000000000001000000000000: ViewFormPages

17: 0000065536: 0000000000000010000000000000000: Open

18: 0000131072: 0000000000000100000000000000000: ViewPages

19: 0000262144: 0000000000001000000000000000000: AddAndCustomizePages

20: 0000524288: 0000000000010000000000000000000: ApplyThemeAndBorder

21: 0001048576: 0000000000100000000000000000000: ApplyStyleSheets

22: 0002097152: 0000000001000000000000000000000: ViewUsageData

23: 0004194304: 0000000010000000000000000000000: CreateSSCSite

24: 0008388608: 0000000100000000000000000000000: ManageSubwebs

25: 0016777216: 0000001000000000000000000000000: CreateGroups

26: 0033554432: 0000010000000000000000000000000: ManagePermissions

27: 0067108864: 0000100000000000000000000000000: BrowseDirectories

28: 0134217728: 0001000000000000000000000000000: BrowseUserInfo

29: 0268435456: 0010000000000000000000000000000: AddDelPrivateWebParts

30: 0536870912: 0100000000000000000000000000000: UpdatePersonalWebParts

31: 1073741824: 1000000000000000000000000000000: ManageWeb

65: 0000065535: 0000000000000001111111111111111: FullMask

And for the high “PermissionKinds” from 33 to 64:

37: 0000000016: 0000000000000000000000000010000: UseClientIntegration

38: 0000000032: 0000000000000000000000000100000: UseRemoteAPIs

39: 0000000064: 0000000000000000000000001000000: ManageAlerts

40: 0000000128: 0000000000000000000000010000000: CreateAlerts

41: 0000000256: 0000000000000000000000100000000: EditMyUserInfo

63: 1073741824: 1000000000000000000000000000000: EnumeratePermissions

65: 0000032767: 0000000000000000111111111111111: FullMask

As you can see the “FullMask” don’t cover all permissions. In the low “PermissionKinds”, the permissions from “Open” to “ManageWeb” and in the high PermissionKinds, the permission “EnumeratePermissions”, are not included.

The “FullMask” should be like this to cover all “PermissionKinds”:

65: 2147483647: 1111111111111111111111111111111: FullMask

To only cover all now available permissions, the “FullMask” could be also like this:

For the low “PermissionKinds”:

65: 2147425279: 1111111111111110001101111111111: FullMask

And for the high “PermissionKinds”:

65: 1073742320: 1000000000000000000000111110000: FullMask

In the (Server) SharePoint Object Model (Not Client) everything is correct:

0000000000000000001: 000000000000000000000000000000000000000000000000000000000000001: ViewListItems

0000000000000000002: 000000000000000000000000000000000000000000000000000000000000010: AddListItems

0000000000000000004: 000000000000000000000000000000000000000000000000000000000000100: EditListItems

0000000000000000008: 000000000000000000000000000000000000000000000000000000000001000: DeleteListItems

0000000000000000016: 000000000000000000000000000000000000000000000000000000000010000: ApproveItems

0000000000000000032: 000000000000000000000000000000000000000000000000000000000100000: OpenItems

0000000000000000064: 000000000000000000000000000000000000000000000000000000001000000: ViewVersions

0000000000000000128: 000000000000000000000000000000000000000000000000000000010000000: DeleteVersions

0000000000000000256: 000000000000000000000000000000000000000000000000000000100000000: CancelCheckout

0000000000000000512: 000000000000000000000000000000000000000000000000000001000000000: ManagePersonalViews

0000000000000002048: 000000000000000000000000000000000000000000000000000100000000000: ManageLists

0000000000000004096: 000000000000000000000000000000000000000000000000001000000000000: ViewFormPages

0000000000000008192: 000000000000000000000000000000000000000000000000010000000000000: AnonymousSearchAccessList

0000000000000065536: 000000000000000000000000000000000000000000000010000000000000000: Open

0000000000000131072: 000000000000000000000000000000000000000000000100000000000000000: ViewPages

0000000000000262144: 000000000000000000000000000000000000000000001000000000000000000: AddAndCustomizePages

0000000000000524288: 000000000000000000000000000000000000000000010000000000000000000: ApplyThemeAndBorder

0000000000001048576: 000000000000000000000000000000000000000000100000000000000000000: ApplyStyleSheets

0000000000002097152: 000000000000000000000000000000000000000001000000000000000000000: ViewUsageData

0000000000004194304: 000000000000000000000000000000000000000010000000000000000000000: CreateSSCSite

0000000000008388608: 000000000000000000000000000000000000000100000000000000000000000: ManageSubwebs

0000000000016777216: 000000000000000000000000000000000000001000000000000000000000000: CreateGroups

0000000000033554432: 000000000000000000000000000000000000010000000000000000000000000: ManagePermissions

0000000000067108864: 000000000000000000000000000000000000100000000000000000000000000: BrowseDirectories

0000000000134217728: 000000000000000000000000000000000001000000000000000000000000000: BrowseUserInfo

0000000000268435456: 000000000000000000000000000000000010000000000000000000000000000: AddDelPrivateWebParts

0000000000536870912: 000000000000000000000000000000000100000000000000000000000000000: UpdatePersonalWebParts

0000000001073741824: 000000000000000000000000000000001000000000000000000000000000000: ManageWeb

0000000002147483648: 000000000000000000000000000000010000000000000000000000000000000: AnonymousSearchAccessWebLists

0000000068719476736: 000000000000000000000000001000000000000000000000000000000000000: UseClientIntegration

0000000137438953472: 000000000000000000000000010000000000000000000000000000000000000: UseRemoteAPIs

0000000274877906944: 000000000000000000000000100000000000000000000000000000000000000: ManageAlerts

0000000549755813888: 000000000000000000000001000000000000000000000000000000000000000: CreateAlerts

0000001099511627776: 000000000000000000000010000000000000000000000000000000000000000: EditMyUserInfo

4611686018427387904: 100000000000000000000000000000000000000000000000000000000000000: EnumeratePermissions

9223372036854775807: 111111111111111111111111111111111111111111111111111111111111111: FullMask

In the “Microsoft.SharePoint.Client.dll”  there is a limitation value in the BasePermission” class:
In the function “Set”:

And in the function “Has”:

So the possible value of “FullMask” must be increased for the high values from 32767 to 2147483647 and for the low values also from 65535 to 2147483647 to cover all permissions or for the high values from 32767 to 1073742320 and for the low values also from 65535 to 2147425279 to cover only the now available permissions.

Only then the “PemisionKind FullMask” will really cover all available permissions.
But maybe Microsoft for security reasons limited this values....

Thanks to my colleague “Selim Gezgin” for collecting all this info about this topic.

Kind regards, 
Andre Lage