Before query Business rule

[Fabricio4]

Hi!

So, I have a request to block some users from seeing Projects and Project tasks that aren't related to them.

I've followed the article below to achieve this with before query business rules:

https://servicenowguru.com/business-rules-scripting/controlling-record-access-before-query-business-...

As well as the OOB business rule "incident query".

It worked great for most of my requirements. There is, however, one nagging query that it just won't work with, and that is the query for parent.project_manager on the pm_project_task table. Here's the code:

(function executeRule(current, previous /*null when async*/) {

if (gs.getSession().isInteractive()) {  

   var u = gs.getUserID(); 

   var g = getMyGroups(); 

   var q = current.addQuery('parent.assigned_to', u).addOrCondition('parent.assignment_group', g).addOrCondition('opened_by', u).addOrCondition('parent.additional_assignee_list', 'CONTAINS', u).addOrCondition('parent.project_manager', u).addOrCondition('parent.watch_list', 'CONTAINS', u); 

}
})(current, previous);

All of the queries work flawlessly. Parent.assigned_to, parent.assigment_group, etc. The only one that will not work is parent.project_manager. If that's the only query I use, it returns all of the records regardless of the condition. If I use only one of the other queries in isolation, they will all work.

That's also when I've discovered that I cannot add the parent.project_manager column in the pm_project_task list layout (it won't appear even when I dot walk 'parent'), for some reason, so I'm sure I'm missing something here.

Any ideas?

[salma98]

Can you try using parent.project_manager.sys_id

[Fabricio4 · Accepted solution]

Found out the problem.

Turns out I can't reference 'parent.project_manager' because parent is a generic reference, it could be a number of tables being referenced. Instead, I had to use 'parent.ref_pm_project.project_manager' because the 'project_manager' field is inside the pm_project table, so only referencing parent means I couldn't access it.

Thanks everyone.