moveworks.acl.1.0.1Custom Applicationglobal283546b18a1d051046512e7bcdf736af283546b18a1d051046512e7bcdf736af:-1907367776,14d56ff6c80dc1107d84cfa3e4db585d:12858213INSERT_OR_UPDATE8e9e72261b8918105394fc88cc4bcb46customersys_ws_query_parameter_219a53081b9d1c105394fc88cc4bcb592edf4fe61b3814105394fc88cc4bcb0dusertrueUser sys_id for whom to fetch access info.sys_ws_query_parameteradmin2022-01-18 18:33:23219a53081b9d1c105394fc88cc4bcb591userglobal8e9e72261b8918105394fc88cc4bcb46sys_ws_query_parameter_219a53081b9d1c105394fc88cc4bcb59admin2022-01-27 20:23:15aaf4178a1b85d4105394fc88cc4bcbc8]]>7880046083d7552f1475d051078d38a5f746d43eafalseadmin2022-01-27 20:23:57357552f1475d051078d38a5f746d43ec017e9d35649e0000001admin2022-01-27 20:23:57
userScripted REST Query Parameterglobala3451eb1995d05107a43fb274c9a16bfa3451eb1995d05107a43fb274c9a16bf:788004608,d6d5eff64b0dc110e8913144f55cbfab:2112767180INSERT_OR_UPDATE8e9e72261b8918105394fc88cc4bcb46customersys_properties_469eb2261b8918105394fc88cc4bcbf1Version Number for the moveworks.acl modulefalsefalsemoveworks.acl.versionsys_propertiesadmin2022-01-18 18:33:16469eb2261b8918105394fc88cc4bcbf12moveworks.acl.versionglobal8e9e72261b8918105394fc88cc4bcb46sys_properties_469eb2261b8918105394fc88cc4bcbf1admin2022-01-27 20:23:10string1.0.1]]>-4095730763d7552f1475d051078d38a5f746d43eafalseadmin2022-01-27 20:23:57397552f1475d051078d38a5f746d43eb017e9d3564800000001admin2022-01-27 20:23:57
ad9ad3081b9d1c105394fc88cc4bcb05Scripted REST Query Parameter Associatioglobalbf451eb1115d05105137bfb6c9ce0fc3bf451eb1115d05105137bfb6c9ce0fc3:589243652,b6d5eff6740dc1109d423aa8879623db:1501441568INSERT_OR_UPDATE8e9e72261b8918105394fc88cc4bcb46customersys_ws_operation_2a9910242f1bd410d631db9df699b652<?xml version="1.0" encoding="UTF-8"?><record_update table="sys_ws_operation"><sys_ws_operation action="INSERT_OR_UPDATE"><active>true</active><consumes>application/json,application/xml,text/xml</consumes><consumes_customized>false</consumes_customized><default_operation_uri/><enforce_acl/><http_method>GET</http_method><name>get_access_info</name><operation_script><![CDATA[/*eslint-env es6*/
/* MARK: CONSTANTS */
// MTOM Table Configuration
const MTOM_TABLE_MAP = {
sc_cat_item: {
mtomQueryKey: 'sc_cat_item', // attribute in the MTOM table that links back to the resource
tables: {
available_for: "sc_cat_item_user_criteria_mtom",
not_available_for: "sc_cat_item_user_criteria_no_mtom",
}
},
kb_knowledge: {
mtomQueryKey: 'kb_knowledge_base', // attribute in the MTOM table that links back to the resource
tables: {
available_for: "kb_uc_can_read_mtom",
not_available_for: "kb_uc_cannot_read_mtom",
}
},
};
// Complete list of user attributes that an entitlement can be configured against.
const ENTITLEMENT_ATTRIBUTES = [
"user", "company", "dept", "location", "group"
];
/* MARK: UTILS */
/**
* GlideScript equivalent of Object.assign in JavaScript.
* @param {*} target JSON object to copy values to.
* @param {*} source JSON object to copy values from.
*/
function objectAssign(target, source) {
for (var key in source) {
target[key] = source[key]
}
}
/* MARK: EXTERNAL TABLES - USER CRITERIA */
/**
* Fetches all UserCriteria on a recordID of type resourceType
* @param {*} recordID sys_id of the record to fetch UserCriteria for.
* @param {*} resourceType type of resource: kb_knowledge, sc_cat_item
*/
function getMTOMCriteria(recordID, resourceType) {
// Note: Object Destructuring not Supported in GlideScript
var mtomConfig = MTOM_TABLE_MAP[resourceType]
var mtomQueryKey = mtomConfig.mtomQueryKey;
var tables = mtomConfig.tables;
var mtomResult = {}
for (var criteriaType in tables) {
// Get all UserCriteria Records where mtomEntry.mtomQueryKey == recordID
var mtomEntry = new GlideRecord(tables[criteriaType]);
mtomEntry.addQuery(mtomQueryKey, recordID);
mtomEntry.query();
// Convert the GlideRecord query into an Array of sys_ids
var userCriteriaRecords = []
while (mtomEntry.next()) {
userCriteriaRecords.push(mtomEntry.user_criteria.sys_id.toString());
}
mtomResult[criteriaType] = userCriteriaRecords
}
return mtomResult;
}
/* MARK: EXTERNAL TABLES - LEGACY USER ENTITLEMENTS */
/**
* Returns a list of other SNOW Objects that match User Entitlements for a given Record
* @param {*} attr Type of record: user, dept, company, etc.
* @param {*} type Type of MTOM: no_mtom, mtom
* @param {*} recordID RecordID to search matches for.
*/
function getUserEntitlementMatches(attr, type, recordID) {
var table = ['sc_cat_item', attr, type].join('_')
var entitlementsQuery = new GlideRecord(table);
entitlementsQuery.addQuery("sc_cat_item", recordID);
entitlementsQuery.query();
var entitlements = []
while (entitlementsQuery.next()) {
entitlements.push(entitlementsQuery.getValue('sc_avail_' + attr))
}
return entitlements
}
/**
* Returns a dictionary of all types of User Entitlements that a given record has.
* @param {*} recordID recordID to fetch Entitlements for
*/
function getAllUserEntitlements(recordID) {
var entitlementsForRecord = {}
for (var i in ENTITLEMENT_ATTRIBUTES) {
var attr = ENTITLEMENT_ATTRIBUTES[i]
entitlementsForRecord[attr] = {}
entitlementsForRecord[attr].available_for = getUserEntitlementMatches(attr, 'mtom', recordID)
entitlementsForRecord[attr].not_available_for = getUserEntitlementMatches(attr, 'no_mtom', recordID)
}
return entitlementsForRecord;
}
function getUserInfo(userID, ENTITLEMENTS_ENABLED) {
var glideUser = gs.getUser().getUserByID(userID);
var userInfo = {
roles: glideUser.getRoles().toArray(),
user_criteria: SNC.UserCriteriaLoader.getAllUserCriteria(userID)
};
if (ENTITLEMENTS_ENABLED) {
// Augment User Information with their Entitlement Attributes
var userRecord = glideUser.getRecord();
userInfo.entitlements = {
user: userID,
company: userRecord.getValue('company'),
department: userRecord.getValue('department'),
location: userRecord.getValue('location'),
group: glideUser.getMyGroups().toArray()
}
}
return userInfo;
}
/* MARK: REST ENDPOINT */
// eslint-disable-next-line no-unused-vars
(function process(/*RESTAPIRequest*/ request, /*RESTAPIResponse*/ response) {
// Deconstruct the Query
var queryParams = request.queryParams;
var userIDs = queryParams.user;
var recordIDs = queryParams.record;
var table = queryParams.table;
const ENTITLEMENTS_ENABLED = gs.getProperty("moveworks.acl.check_legacy_entitlements") == "true";
const IS_KNOWLEDGE_QUERY = (table == 'kb_knowledge');
var result = {};
// Get Information about the Users
result['user'] = [];
for (var userIdx in userIDs) {
var userID = userIDs[userIdx];
result.user.push(getUserInfo(userID, ENTITLEMENTS_ENABLED));
}
// Setup Records Response
result[table] = [];
if (IS_KNOWLEDGE_QUERY) result.kb_knowledge_base = {};
for (var recordIdx in recordIDs) {
var recordID = recordIDs[recordIdx];
var recordInfo = {}
// Get Information from the Resource Record
var resource = new GlideRecord(table);
resource.get(recordID);
var roles = resource.roles.toLowerCase(); // glideUser.getRoles() makes all roles lowercase even if the source differs.
recordInfo.roles = roles == '' ? [] : roles.split(",");
if (IS_KNOWLEDGE_QUERY) {
recordInfo.kb_knowledge_base = resource.kb_knowledge_base;
recordInfo.available_for = resource.can_read_user_criteria.split(',') || [];
recordInfo.not_available_for = resource.cannot_read_user_criteria.split(',') || [];
}
if (ENTITLEMENTS_ENABLED && !IS_KNOWLEDGE_QUERY) recordInfo.entitlements = getAllUserEntitlements(recordID);
// Get Information from related MTOMs
// If it's a knowledge query, use the `kb_knowledge_base` attribute on the resource. Otherwise, use the recordID.
var mtomUserCriteria = getMTOMCriteria(IS_KNOWLEDGE_QUERY ? resource.kb_knowledge_base : recordID, table);
if (IS_KNOWLEDGE_QUERY) {
result.kb_knowledge_base[resource.kb_knowledge_base] = mtomUserCriteria;
} else {
objectAssign(recordInfo, mtomUserCriteria);
}
result[table].push(recordInfo)
}
return result;
})(request, response);
]]></operation_script><operation_uri>/api/488834/moveworks/acl/get_access_info</operation_uri><produces>application/json,application/xml,text/xml</produces><produces_customized>false</produces_customized><relative_path>/acl/get_access_info</relative_path><request_example/><requires_acl_authorization>true</requires_acl_authorization><requires_authentication>true</requires_authentication><requires_snc_internal_role>true</requires_snc_internal_role><short_description>Returns the basic information required to evaluate if a user should have access </short_description><sys_class_name>sys_ws_operation</sys_class_name><sys_created_by>admin</sys_created_by><sys_created_on>2022-01-18 18:33:33</sys_created_on><sys_id>2a9910242f1bd410d631db9df699b652</sys_id><sys_mod_count>2</sys_mod_count><sys_name>get_access_info</sys_name><sys_package display_value="Global" source="global">global</sys_package><sys_policy/><sys_scope display_value="moveworks.acl.1.0.1">8e9e72261b8918105394fc88cc4bcb46</sys_scope><sys_update_name>sys_ws_operation_2a9910242f1bd410d631db9df699b652</sys_update_name><sys_updated_by>admin</sys_updated_by><sys_updated_on>2022-01-27 20:23:21</sys_updated_on><web_service_definition display_value="moveworks">aaf4178a1b85d4105394fc88cc4bcbc8</web_service_definition><web_service_version/></sys_ws_operation></record_update>14371035193d7552f1475d051078d38a5f746d43eafalseadmin2022-01-27 20:23:57bd7552f1475d051078d38a5f746d43eb017e9d3565010000001admin2022-01-27 20:23:57
get_access_infoScripted REST Resourceglobal01559eb1dd5d05105d907fd03e3fe13e01559eb1dd5d05105d907fd03e3fe13e:1437103519,8de5633aca0dc1101d0f7363bb45f24d:1480739223INSERT_OR_UPDATE8e9e72261b8918105394fc88cc4bcb46customersys_ws_query_parameter_5dd89a881bd91c105394fc88cc4bcbc0sc_cat_itemtabletrueTable that contains the records. One of sc_cat_item, kb_knowledge.sys_ws_query_parameteradmin2022-01-18 18:33:225dd89a881bd91c105394fc88cc4bcbc01tableglobal8e9e72261b8918105394fc88cc4bcb46sys_ws_query_parameter_5dd89a881bd91c105394fc88cc4bcbc0admin2022-01-27 20:23:14aaf4178a1b85d4105394fc88cc4bcbc8]]>11937014783d7552f1475d051078d38a5f746d43eafalseadmin2022-01-27 20:23:57f57552f1475d051078d38a5f746d43ec017e9d3564960000001admin2022-01-27 20:23:57
tableScripted REST Query Parameterglobal534596b1f95d05102d0cf4bee80a34a7534596b1f95d05102d0cf4bee80a34a7:1193701478,02d5eff6500dc11063ef974e935b45a8:1172300326INSERT_OR_UPDATE8e9e72261b8918105394fc88cc4bcb46customersys_properties_febfe6f2f87811cb243d10438dce48e3Platform Permissions Optimization to reduce number of queries for customers that don't support legacy user entitlements.falsefalsemoveworks.acl.check_legacy_entitlementssys_propertiesadmin2022-01-27 19:12:59febfe6f2f87811cb243d10438dce48e31moveworks.acl.check_legacy_entitlementsglobal8e9e72261b8918105394fc88cc4bcb46sys_properties_febfe6f2f87811cb243d10438dce48e3admin2022-01-27 20:23:17booleanfalse]]>17924141213d7552f1475d051078d38a5f746d43eafalseadmin2022-01-27 20:23:57f97552f1475d051078d38a5f746d43eb017e9d3564e10000001admin2022-01-27 20:23:57
moveworks.acl.check_legacy_entitlementsSystem Propertyglobal60555eb13c5d0510780ddb3932d8c0c160555eb13c5d0510780ddb3932d8c0c1:1792414121,a235c6b1c01d0510cd174b10a52b116b:2117232955INSERT_OR_UPDATE8e9e72261b8918105394fc88cc4bcb46customersys_ws_query_parameter_ad9ad3081b9d1c105394fc88cc4bcb0503df4fe61b3814105394fc88cc4bcba0, 03df4fe61b3814105394fc88cc4bcba1, 03df4fe61b3814105394fc88cc4bcba2recordtrueComma-separated records for which to fetch access info.sys_ws_query_parameteradmin2022-01-18 18:33:20ad9ad3081b9d1c105394fc88cc4bcb051recordglobal8e9e72261b8918105394fc88cc4bcb46sys_ws_query_parameter_ad9ad3081b9d1c105394fc88cc4bcb05admin2022-01-27 20:23:13aaf4178a1b85d4105394fc88cc4bcbc8]]>19064930533d7552f1475d051078d38a5f746d43eafalseadmin2022-01-27 20:23:57fd7592f1475d051078d38a5f746d4311017e9d35648b0000001admin2022-01-27 20:23:57