Restricting access via Query Business Rules

[Ayman Lhend1]

Hello, 
I'm trying to restrict access to only a specific group(s) of some RITM records depending on the category of the item included in that item request, but for various reasons, i cannot use ACLs in this use case.

So i'm trying to find a workaround using Query BR, which don't seem to fit since i don't have access to the current object which will give me information about the requested item and its category.

If anyone knows a way to get it done i would really appreciate, even if it's a way outside of Query BR.

Thank you.

[Brad Bowman · Accepted solution]

I created a single table Database View on sc_req_item so I wouldn't mess with the list view of the table for everyone else, and can create a Query Business Rule to only show RITMs where the Category of the Item is Office, for example.  Note that since this BR is running on a DB View, 'ritm' is the table prefix I used, so it has to be used in the BR script also.

(function executeRule(current, previous /*null when async*/) {
	current.addQuery('ritm_cat_item.category', '109cdff8c6112276003b17991a09ad65'); // Office
})(current, previous);

[Ayman Lhend1]

Yes, thank you, this works just fine.

But there's another thing that came up which i'm struggling with that i did not mention on my question.

Assuming that every REQ has only one unique RITM, is it possible to do the same access restriction for the REQ, depending on the category of the RITM related to the REQ, i cannot manage to do this since the current object on the before query BR is always empty, understandably so.

[Brad Bowman]

Sure.  So on a Database view of the sc_request table where the variable prefix is 'req' and the Database View name (in my example) is 'u_bkb_req_qbr', the Query Business Rule script would look like this:

(function executeRule(current, previous /*null when async*/) {
	var recArr = [];
	var req = new GlideRecord('u_bkb_req_qbr'); //database view name
	req.query();
	while (req.next()) {
		var ritm = new GlideRecord('sc_req_item');
		ritm.addQuery('request', req.req_sys_id);
		ritm.addQuery('cat_item.category', '109cdff8c6112276003b17991a09ad65'); //Office
		ritm.query();
		if (ritm.next()) {
			recArr.push(req.req_sys_id.toString());
		}
	}
	current.addQuery('req_sys_id', 'IN', recArr.join(','));
})(current, previous);

[Ayman Lhend1]

Although your proposition makes a lot of sense, with the amount of requests that our instance has, this BR takes too much computing time to get executed and for the browser to get back to me, it's just not practical time-wise.

But thank you so much for your replies, very helpful !