Role-Based Edit and Access Rights

Rights for Unbound UI Controls

In UI contracts, you can set attributes on select UI controls to determine whether they’re visible or editable based on the user roles of the user. You can either specify the required user roles individually, or select all of the user roles together. By default, all roles have edit and view rights for the relevant UI controls.

An unbound UI control isn’t bound to a business object, such as an ImageButton or a MenuItem. These unbound UI controls support user role-based edit and access rights:

• Image buttons
• Tab
• Menu items

Rights for Business Objects and Business Object Properties

In business logic, you can use user roles (actors) to control the edit and access rights to business objects and their properties. Four framework functions are available for this purpose. These functions are made available by the FrameworkUser class of the framework. The current application user business object is derived from this class if the baseClass property of BoUser has the value, FrameworkUser:

<BusinessObject name="BoUser" generateLoadMethod="false" xmlns="BoSchema.xsd" schemaVersion="1.1" baseClass="FrameworkUser" OERReference="UsrUser">

In the advanced editor in Consumer Goods Cloud Modeler, you can maintain baseClass as a property of a business object.

Example: Using hasRole() to Verify and Assign Edit and Access Rights

The example shows the basic steps for using the FrameworkUser method, hasRole(), to verify a user's roles and to set the edit and access rights on the properties of a business object.

In the relevant process contract, in a Logic action, pass the application user as an input parameter to the business logic contract that handles the edit and access rights verification.

<Parameters>
  <Input name="user" value="ApplicationContext:user" />
</Parameters>

In the business logic contract, handle the passed user:

<MethodInput name="user" type="BoUser" />

Verify the user for the existence of a particular role by using hasRole():

var bHasRole = user.hasRole("MobileDSDDriver");

Based on the results of the verification, assign edit and access rights to a business object or to the simple properties of an individual business object.

if (bHasRole === false) {
    var aclBoOrderRole = me.getBoOrderRole().getACL();
    
        aclBoOrderRole.addRight(AclObjectType.PROPERTY, "ordererType", AclPermission.VISIBLE);
        aclBoOrderRole.addRight(AclObjectType.PROPERTY, "sdoMetaBlocked", AclPermission.VISIBLE);
}