Restrict visibility announcement on portal to specific groups.

[PRAVALIKAREDDYL]

Hi,

I have a requirement to restrict the visibility of an announcement tile on the portal so that only members of specific groups can see it.

What I have done so far:

• Unchecked the Public option on the announcement
• Added User Criteria under Can View
• In the User Criteria, I specified the required groups and saved it

Issue:

Even though I am not a member of those groups, I am still able to see the announcement tile on the portal.

Additional details:

• The announcement is being fetched and displayed using a custom widget
• I suspect the User Criteria may not be getting evaluated properly at the widget level

Questions:

Why am I still able to see the announcement even though I don’t meet the User Criteria?

Does User Criteria automatically get enforced when announcements are fetched via a custom widget?

Do we need to explicitly evaluate User Criteria in the widget server script to restrict visibility?

If yes, what is the recommended way to evaluate User Criteria or group membership in the widget?

I am sharing the widget code below for reference.

Any guidance or best practices on implementing this requirement would be really helpful.

Thank you!


CODE:

(function() {

    data.resources = [];

    var grType = new GlideRecord('announcement_consumer_type');

    grType.addQuery('sys_id', options.announcement_type);

    grType.query();

    if (grType.next()) {

        var grAnnouncement = new GlideRecord('announcement');

        grAnnouncement.addQuery('active', true);

        grAnnouncement.addEncodedQuery('typeLIKE' + grType.sys_id);

        grAnnouncement.addEncodedQuery('from<=javascript&colon;gs.endOfToday()^to>=javascript&colon;gs.beginningOfToday()^ORtoISEMPTY');

        grAnnouncement.orderBy('u_order_by');

        grAnnouncement.query();

        while (grAnnouncement.next()) {

            if (grAnnouncement['public'] || gs.hasRole(grAnnouncement.roles)) {

                var resource = {};

                resource.hide_on_mobile = grAnnouncement.getValue('u_hide_on_mobile'); 

                $sp.getRecordDisplayValues(resource, grAnnouncement, 'name,title,summary,glyph,click_target,details_url,details_page,u_image_url');

                resource.isMobile = true; 

                data.resources.push(resource);

            }

        }

    }

})();

[Rushi Savarkar]

Hello @PRAVALIKAREDDYL 

Before replacing the script, please check below point

Admin Overrides: If you are testing with an admin account, remember that admins often bypass certain criteria checks. Always test with a non-admin user who is strictly outside those groups.

(function() {
    data.resources = [];
    var grType = new GlideRecord('announcement_consumer_type');
    grType.addQuery('sys_id', options.announcement_type);
    grType.query();
    
    if (grType.next()) {
        var grAnnouncement = new GlideRecord('announcement');
        grAnnouncement.addQuery('active', true);
        grAnnouncement.addEncodedQuery('typeLIKE' + grType.sys_id);
        grAnnouncement.addEncodedQuery('from<=javascript&colon;gs.endOfToday()^to>=javascript&colon;gs.beginningOfToday()^ORtoISEMPTY');
        grAnnouncement.orderBy('u_order_by');
        grAnnouncement.query();
        
        while (grAnnouncement.next()) {
            // REPLACEMENT LOGIC START
            // $sp.canReadRecord automatically evaluates User Criteria (Can View/Cannot View)
            if ($sp.canReadRecord(grAnnouncement)) {
                var resource = {};
                resource.hide_on_mobile = grAnnouncement.getValue('u_hide_on_mobile'); 
                $sp.getRecordDisplayValues(resource, grAnnouncement, 'name,title,summary,glyph,click_target,details_url,details_page,u_image_url');
                resource.isMobile = true; 
                data.resources.push(resource);
            }
            // REPLACEMENT LOGIC END
        }
    }
})();

[PRAVALIKAREDDYL]

Actually, we are using this widget in one page where we are evaluating the announcement consumer type, and we are displaying the announcements on the page. 
i have added the logic in the server script, and tested with non-admin account, but still i am seeing the announcement on the page.